Safety of laboratories, plants, facilities being ...

REPORT

Safety of laboratories, plants, facilities being dismantled, waste processing, interim storage and disposal facilities Lessons learned from events reported in 2009 and 2010 DSU Report 248

PLANTS, LABORATORIES, TRANSPORTS AND WASTE SAFETY DIVISION

Enhancing Nuclear Safety, Security and Radiation Protection

The Institute for Radiological Protection and Nuclear Safety set up by law 2001-398 of 9 May 2001, is the French

national public expert in nuclear and radiological risks. IRSN contributes to the implementation of public poli-

cies concerning nuclear safety and security, health and environmental protection against ionizing radiation. As a

research and expert appraisal organisation, IRSN works together with all the parties concerned by these policies

while preserving its independence of judgment.

The French organisaTion For nuclear saFeTy, securiTy and radiaTion ProTecTion n Operators are responsible for safety of their facilities. They must

demonstrate relevance of technical and organisational solutions applied for this purpose (safety files and release impact studies).

n Public authorities (Ministries, Nuclear Safety Authority – ASN, Defence Nuclear Safety Authority – DSND) define nuclear safety, security and radiation protection policies. They organise and implement checking in compliance with law 2006-686 of 13 June 2006 governing transparency and safety in nuclear matters.

n IRSN assesses the files submitted by operators to the different com-petent authorities. It permanently analyzes plant operating experience feedback. It assesses exposure of man and the environment to radiation and proposes measures to protect the population in the event of an accident. Nuclear safety being largely science based, IRSN’s expertise capability is permanently enhanced through its research activities, usu-ally developped in an international framework.

n Local Information Committees (CLI) and the High Committee for Nuclear Transparency (HCTISN) gather the stakeholders concerned by nuclear facilities, and constitute leading bodies for access to information and monitoring of safety and security, health and environmental protection issues.

Designers manufacturers

Operators

Parliament

Public authorities

Civil society

Stakeholders(CLI)

Research on risks

IRSN, public expert appraisal

www.irsn.fr

BeaumontHague

Paris

Lille

Strasbourg

Lyon

Bourges

ToulouseMontpellier

Nice

Biarritz

Tours

Brest

SARA Stations (aerosol monitoring)

Téléray Stations (gamma radiation monitoring)

Remote air radioactivity monitoring networks:

IRSN sites

Head office

VAIRAO

IRSN key numbers1,786 persons 1,200 researchers and experts M€321 (2010 budget)

n Nuclear safety and security q Reactors q Fuel cycle q Waste management q Transport q Radioactive sources

n Radiological protection of people (including patients) and of the environment

n Nuclear & radiological emergency management and operational intervention capability

n Training and educationn Information management and interaction with

stakeholders and the public

irsn Key Fields oF comPeTence – r&d and oPeraTional exPerTise caPabiliTy

TABLE OF CONTENTS

1 INTRODUCTION...............................................................................4

2 LUDD FACILITIES ............................................................................5

2.1 NUCLEAR FUEL CYCLE FACILITIES: 15 BASIC NUCLEAR FACILITIES AT THE END OF 2010 ........ 5

2.2 OUT-OF-CYCLE INDUSTRIAL FACILITIES: 13 BASIC NUCLEAR INSTALLATIONS AT THE END OF

2010.......................................................................................................... 6

2.3NUCLEAR RESEARCH AND RELATED SUPPORT FACILITIES: 16 BASIC NUCLEAR

INSTALLATIONS AT THE END OF 2010................................................................... 6

2.4 RADIOACTIVE WASTE DISPOSAL FACILITIES: TWO BASIC NUCLEAR INSTALLATIONS AT THE END

OF 2010...................................................................................................... 7

2.5 FACILITIES DEFINITIVELY SHUT DOWN OR BEING DISMANTLED: 26 BASIC NUCLEAR

INSTALLATIONS AT THE END OF 2010................................................................... 7

2.6 CHARACTERISTICS OF LUDD-TYPE FACILITIES .......................................................... 7

2.7 GENERAL SAFETY APPROACH ............................................................................. 8

3 MAIN OBSERVED TRENDS ..................................................................9

4 CROSS-DISCIPLINARY ANALYSIS OF EVENTS AT LUDD FACILITIES ............... 12

4.1 EVENTS RELATING TO THE RISK OF THE DISSEMINATION OF RADIOACTIVE MATERIALS.........13

4.2 EVENTS RELATING TO RISKS OF EXPOSURE TO IONISING RADIATION ..............................17

4.3 EVENTS RELATING TO THE CRITICALITY RISKS ........................................................20

4.4 EVENTS RELATING TO THE RISK OF FIRE OR EXPLOSION ............................................23

4.5 EVENTS RELATING TO THE RISKS ASSOCIATED FROM HANDLING OPERATIONS ...................26

4.6 ANALYSIS OF TECHNICAL CAUSES .......................................................................28

4.7 ANALYSIS OF HUMAN AND ORGANISATIONAL CAUSES ................................................30

5 EVENTS AND INCIDENTS.................................................................. 36

5.1 EVENTS THAT OCCURRED DURING DECONTAMINATION OR DISMANTLING OPERATIONS ........37

5.2 EVENTS RELATING TO IONISATION FACILITIES ........................................................43

5.3 EVENTS RESULTING FROM FAILURES TO MANAGE QUANTITIES OF FISSILE MATERIALS..........49

6 SUMMARY ................................................................................... 56

APPENDIX : REPORTING CRITERIA FOR SIGNIFICANT EVENTS RELATING TO SAFETY,

RADIATION PROTECTION AND THE ENVIRONMENT, PRESENTED IN THE ASN GUIDE OF 21 OCTOBER 2005 ................................................................................ 59

DSU Report 248 3/60

1 INTRODUCTION

Maintaining high levels of safety and radiation protection in nuclear facilities requires constant vigilance by

everyone involved, especially plant operators, who are first and foremost responsible for safety in their facilities.

Safety can never be taken for granted; constant efforts must be expended to improve it by taking new knowledge

from research and available national and international operating experience feedback into account.

At the end of 2010, France had 72 basic nuclear facilities (INB) not including reactors in operation. Designated by the French acronym LUDD, they include laboratories, plants, facilities being dismantled, waste processing, interim storage and disposal facilities. Quite varied in type, these facilities are operated by AREVA, CEA, EDF and ANDRA, among others.

To promote wider access to operating experience feedback,

IRSN published an initial report, DSU Report 215, in December

2009 (accessible on the IRSN’s website:

http://www.irsn.fr/EN/) on general safety lessons from basic

nuclear facilities not including operating reactors on the basis

of a cross-disciplinary analysis of events reported to the

French Nuclear Safety Authority (ASN) during 2005-2008.

The present report is a continuation of DSU Report 215. Without claiming to be exhaustive, it presents lessons

from IRSN’s cross-disciplinary analysis of events reported to ASN during 2009 and 2010 at LUDD facilities while

highlighting major changes from the previous analysis in order to underline improvements, areas where progress

has been made, and main points for monitoring.

The report has four sections:

the first gives a brief introduction to the various kinds of LUDD facilities and highlights changes with DSU

Report 215;

the second provides a summary of major trends involving events reported to ASN during 2007-2010 as well

as overall results of consequences of events reported during 2009 and 2010 for workers, the general

public and the environment;

the third section gives a cross-disciplinary analysis of significant events reported during 2009 and 2010,

performed from two complementary angles (analysis of main types of events grouped by type of risk and

analysis of generic causes). Main changes from the analysis given in DSU Report 215 are considered in

detail;

the last section describes selected significant events that occurred in 2009 and 2010 in order to illustrate

the cross-disciplinary analysis with concrete examples.

IRSN will publish this type of report periodically in coming years in order to present a regular update on observed

improvements and areas where progress can be made with the overall goal of encouraging continuing

enhancement of French nuclear facility safety.

DSU Report 248 4/60

DSU Report 248 5/60

2 LUDD FACILITIES

In addition to the national nuclear power fleet operated by Electricité de France (EDF), which consists of 58

pressurised water reactors (PWRs), and ten operating research reactors, France had, at the end of 2010, 72 other

basic nuclear facilities (INB). Designated by the French acronym LUDD, they include laboratories, plants, facilities

being dismantled, waste processing, interim storage and disposal facilities.

Unlike nuclear power reactors, which have a similar design and are

all operated by EDF, LUDD facilities are quite varied (both in terms

of activity and risks) and are operated primarily by AREVA, CEA,

Andra and EDF, and others. The LUDD classification into five main

groups is the same as that given in the previous public report for

2005-2008. During 2009 and 2010, several changes, highlighted in

the brief introduction given below, were made to these groups.

2.1 NUCLEAR FUEL CYCLE FACILITIES: 15 BASIC NUCLEAR FACILITIES AT THE END OF 2010

In contrast with the previous report, the ATPu facility at CEA’s Cadarache site that manufactured MOX fuels and

the associated LPC facility and the HAO unit of the UP2-400 treatment plant at La Hague, which were subject to

final shutdown and dismantling orders in 2009, are no longer part of this group. These three facilities are now

classified as shut down or in the process of being dismantled.

This group includes thirteen facilities

operated by AREVA that prepare nuclear

fuel for use in nuclear reactors and

process spent fuel. Two new uranium

oxide-based fuel storage facilities

operated by EDF are also included in

this group.

Classification criteria for basic nuclear facilities are defined in Decree 2007-830 of 11 May 2007 in application of Act 2006-686 of 13 June 2006, the Nuclear Transparency and Security Act (TSN).

The thirteen AREVA facilities in this group include:

Georges Besse 1 and 2 uranium enrichment plants at the Tricastin site; TU5 and Comurhex plants at Areva's Pierrelatte site for converting uranium processed from spent fuels; FBFC plants at the Romans-sur-Isère site for fabricating fuel assemblies for pressurised water reactors and fuel

for research reactors; MELOX plant at the Marcoule site for manufacturing MOX fuels; UP3A and UP2-800 spent fuel processing plants in operation at the La Hague site; the older UP2-400 plant has

been shut down and is being prepared for dismantling (except for the HAO unit which has already been subject to a final shutdown and dismantling order) is included in this group.

2.2 OUT-OF-CYCLE INDUSTRIAL FACILITIES: 13 BASIC NUCLEAR INSTALLATIONS AT THE END OF

2010

Since the publication of the public report for 2005-2008, DSU Report 215, this group of facilities has not

changed.

Out-of-cycle industrial facilities include:

artificial radioelement production plant operated by CIS bio international at the Saclay site; six industrial irradiation facilities located at six different sites operated by Ionisos, Isotron France et Cis bio

international; three plants dedicated to maintaining equipment from other basic nuclear facilities: Somanu in Maubeuge and

Socatri and BCOT at the Tricastin site; Centraco facility, operated by Socodei at the Codolet site, which processes and conditions low-level

radioactive waste; laboratory, operated by EDF at the Chinon site, for expert assessments of materials from nuclear power

reactors; storage facility, operated by EDF at the Creys-Malville site, for underwater decay of spent fuel from the

Superphenix reactor.

2.3 NUCLEAR RESEARCH AND RELATED SUPPORT FACILITIES: 16 BASIC NUCLEAR INSTALLATIONS

AT THE END OF 2010

This group, which consists of research facilities, has undergone three changes since the end of 2008:

Two new support facilities were created:

AGATE advanced effluent management and treatment facility at the CEA centre in Cadarache,

ICEDA activated waste conditioning and storage facility at EDF’s Bugey site;

One facility no longer belongs to this group: AGATE facility

LURE accelerator, which was ordered shut down and dismantled in 2009 and now is classified with facilities being dismantled.

In addition to support facilities (management of radioactive waste and liquid effluent and storage of fissile materials and irradiated fuel), this group of basic nuclear facilities includes:

research laboratories operated by the CEA at the Cadarache site (LECA, STAR, CHICADE and LEFCA), Marcoule site (ATALANTE) and Saclay site (LECI);

large-scale heavy ion accelerator (GANIL) operated by GIE-GANIL, a CEA-CNRS joint venture near Caen.

ICEDA facility (June 2011)

DSU Report 248 6/60

DSU Report 248 7/60

2.4 RADIOACTIVE WASTE DISPOSAL FACILITIES: TWO BASIC NUCLEAR INSTALLATIONS AT THE END

OF 2010

France has two near surface disposal facilities operated by Andra for low and intermediate-level short-lived waste

that are classified as basic nuclear facilities:

La Manche waste disposal facility (CSM) near AREVA’s site in La Hague, which has been in a monitoring phase since January 2003;

The Aube waste disposal facility (CSA), in operation in the municipality of Soulaines-Dhuys.

2.5 FACILITIES DEFINITIVELY SHUT DOWN OR BEING DISMANTLED: 26 BASIC NUCLEAR

INSTALLATIONS AT THE END OF 2010

As mentioned above, several basic nuclear facilities have been added to this group since 2008 as the result of final

shutdown and dismantling orders. On the other hand, the Harmonie facility, which was removed from the basic

nuclear facility list in 2009 following dismantling, is no longer included here.

In addition to fourteen laboratories and plants, this group also includes reactors that are definitively shut down

and no longer contain nuclear fuel; in practice, when fuel is removed from the reactor, the risks present in the

facilities resemble those at laboratory and plant-type basic nuclear facilities (including elimination of risks related

to residual power from the reactor).

French nuclear facilities that have been definitively shut down or are being dismantled

2.6 CHARACTERISTICS OF LUDD-TYPE FACILITIES

As the introduction above shows, LUDD-type facilities are very diverse; the type and significance of risks

associated with these facilities and the potential consequences from their operation differ from one facility to the

next. For operating facilities, this diversity is closely related to the characteristics of the radioactive materials

(radionuclides that are present and associated physicochemical forms) as well as the processes (type of reagent,

etc.) used at the facilities.

Décret d’Autorisation de Création

Décret d’Autorisation de Création

La Hague

ReprocessinPlant

g

s t1 facili y

Chooze Nuclear Power Plant

1 facility

Université d’Orsay

1 facility

Construction Decommissioning Final shutdown

Final shutdown and dismantling decree

Strasbourg University Reactor

1 facility

Regulatory phase

Fontenay aux Roses

2 facilities

Operation of facility Bugey Nuclear Power Plant

1 facility

Dismantling operations Technical phase

Saclay

2 facilities Creys-Malville Nuclear Power

Plant 1 facility

The Act of June 2006 relating to transparency and security in the nuclear field, the “TSN Act”, stipulates that the life stages of a basic nuclear facility from construction through dismantling (except for waste disposal facilities for which the dismantling stage is replaced by a monitoring phase) are subject to authorisation by decree. Following dismantling, a facility may be decommissioned and removed from the list of basic nuclear facilities.

SICN Plant Veurey-Voroize

2 facilities

Brennilis

1 facility

Grenoble

4 facilities

Chinon Nuclear Power Plant

3 facilities

Cadarache

4 facilities

Saint-Laurent Nuclear Power

Plant 2 facilities

It must be stressed that the vast majority of these facilities present risks related to organisational and human

factors to the extent that the processes involved and activities performed at these facilities generally require

people to carry out operations near radioactive materials. This is confirmed by operating experience feedback

from events reported to ASN, which often have one or more human or organisational causes (see chapter 4 below).

A summary of the main risks associated with the various types of LUDD facilities is included in the previous public

report available on the IRSN's English website under the heading “Library: Reports and Technical Documents”.

2.7 GENERAL SAFETY APPROACH

2nd level

1st level

Failure prevention based on prudent design and quality construction and operation Facility control

and monitoring 3rd level

Safeguard systems, emergency operating procedures

It is important to recall that safety and radiation protection

measures are determined within a deterministic framework

based on the principle of defence-in-depth that aims to prevent

incidents and accidents or to limit the effects thereof as well as

an optimisation approach to radiation protection.

A crucial element of the nuclear safety approach lies in the

effort to seek continuous improvement. Improving facility

safety implies taking into account new knowledge about safety

and operating experience feedback (dosimetry, waste and

effluent management, incidents and accidents, etc.). In

particular, significant efforts must be expended in analysing

anomalies, incidents and accidents and implementing

modifications and corrective measures that result from this

analysis.

4th level

Emergency plan in case of severe accident

5th level

Limitation of radiological consequrence with an emergency response

Five levels of defence-in-depth

Nuclear safety is the set of technical provisions and organisational measures related to the design, construction, operation, shutdown and dismantling of basic nuclear facilities, as well as the transport of radioactive materials which are adopted with a view to preventing accidents or limiting their effects (Article 1 of the TSN Act).

Events that are not covered by ASN’s reporting criteria are termed “safety-related” events. Practices for informing ASN about these events vary greatly among operators of LUDD facilities. Out of a concern for consistency, only

All operators of basic nuclear facilities are required to report the occurrence of any deviation that falls within the criteria established by ASN (significant events), within no more than two days of detection. They must also provide an analysis of the event in a significant event report within two months. The criteria adopted for defining significant events “involving safety for basic nuclear facilities other than pressurised water reactors,” significant events “involving radiation protection for basic nuclear facilities” and significant events “involving the environment for basic nuclear facilities” are provided in the appendix of this report. Certain events occurring in LUDD-type basic nuclear facilities may be classified as significant with regard to criteria defined for one or more groups of significant events.

DSU Report 248 8/60

DSU Report 248 9/60

108

168

202

172

0

50

100

150

200

250

2007 2008 2009 2010

60

94

109

95

11

2126

18

0 0 2 00

20

40

60

80

100

120

2007 2008 2009 2010

60

94

109

95

11

2126

18

0 0 2 00

20

40

60

80

100

120

2007 2008 2009 2010

25

39

47

37

10

15

20

25

30

35

40

45

50

2007 2008 2009 2010

0

5

3 MAIN OBSERVED TRENDS

This chapter presents the main lessons learned from changes in the number and type of significant

events reported to ASN and an overall assessment of the consequences of these events for

workers, the environment and facilities concerned.

In contrast with the previous report, IRSN's analysis here takes into account only significant events

reported to ASN in order to provide a more consistent picture of trends observed for all basic

nuclear facilities. In effect, reporting practices for “safety-related” events from all operators are

not sufficiently consistent to take into account the events in the analysis in a useful manner.

CHANGES IN THE NUMBER OF EVENTS1 REPORTED TO ASN BETWEEN 2007 AND 2010

Number of significant events reported to ASN between 2007 and 2010 by year

1 The number of events given in the accompanying charts for 2007 and 2008 is slightly different from the one given in the previous report due to the inclusion of events that were reported late by some operators and changes in event classification.

The notable increase in the number of significant

events observed in 2008 in comparison with 2007

(approximately 55%) continued in

2009 (approximately 20%); the trend reversed in

2010, with the number of reported events

approaching the level of 2008.

This general change is noted especially for

reported significant safety events with INES

classification of 0 and events involving the

environment (see diagrams below).

Level 1 Level 0 Level 2

Number of significant safety events between 2007 and 2010 by year

Number of significant environment events between 2007 and 2010 by year

DSU Report 248 10/60

1314

25

28

2

8

3

0 01

0

5

10

15

20

25

30

2007 2008 2009 20

5

0

10

In contrast, for reported events relating to radiation protection, IRSN observes there was a significant increase in

the number of events during 2009 and 2010 in comparison with previous years. This increase involved events

classified as INES Level 0.

Number of significant radiation protection events between 2007 and 2010 by year

Three events reported in 2009 were classified by ASN as level 2 on the INES:

- two events involving safety, which resulted from exceeding weight limits for fissile materials in criticality

units (events took place at the Melox plant on 3 March 2009 and the ATPu facility on 6 October 2009);

- one event relating to radiation protection; it led to internal contamination of worker due to a wound causing

a committed effective dose exceeding the regulatory limit of 20 mSv/year (MaU facility of UP2-400 plant at La

Hague site).

The three incidents are discussed below in the last chapter. No other events at LUDD facilities were classified level

2 during 2007, 2008 or 2010.

Even if prudence is in order in interpreting the reduction in the total number of events reported to ASN, this trend

does not appear to indicate a decline in operator reporting practices. Nevertheless, changes which vary greatly

from overall trends can be observed depending on facilities and sites. In particular, the reduction in the number of

events observed in 2010 was not observed at all facilities. This is the result of improved reporting of minor events

due, in some cases, to the approach initiated by ASN in recent years to ensure more rigorous application of criteria

for reporting significant events. As part of its expert assessment missions on safety at basic nuclear facilities, IRSN

performs an analysis of these changes and alerts ASN when they may result in a diminished level of safety.

The analysis of reporting criteria shows that

this increase is related in particular to

detected deviations in “radiological

cleanliness” of facilities (surface

contamination of rooms exceeds defined

thresholds). This change appears to indicate

improved detection and improved feedback of

deviations to safety documents by operators.

For significant “safety” and “radiation

protection” events classified on the INES, the

diagrams above show a slight decrease in 2010

in the number of level 1 events, with this

number similar to those for 2008 and 2009.

Level 2 Level 1 Level 0

Major Accident

Accident

Serious accident

Accident with wider consequences

Accident with local consequences

Incident

Incident

Serious incident

Anomaly

Deviation

The International Nuclear Event Scale (INES) was created to inform the public. It is applied to events that occur at nuclear facilities, which are classified in seven levels according to their significance.

This process relies in particular on the use of information from databases of events occurring at French and foreign LUDD facilities: the SAPIDE LUDD database managed by IRSN and the FINAS database jointly managed by IAEA and the OECD’s Nuclear Energy Agency. To take into account operating feedback from its use, improvements were made to the coding fields in the SAPIDE LUDD database in 2010. The present report relies in large part on this database.

TAKING ADVANTAGE OF OPERATING EXPERIENCE

FEEDBACK AT IRSN IRSN monitors safety at LUDD-type basic nuclear facilities as part of its expert assessment mission in order to have the most accurate knowledge possible of these facilities and their operating experience feedback. Significant resources are deployed to take advantage of operating feedback from these facilities in order to best adapt expert assessment of facility safety to the risks involved.

Overall assessment of consequences

A very small share (approximately 3%) of

significant events reported to ASN during 2009 and

2010 had a radiological impact outside the

facilities. Radiological consequences of these

events for the environment and population were

negligible (several cases of releases significantly

below authorised limits) and, in most cases, limited

to the sites of facilities concerned.

In 2008, an increase in two types of events

(uncontrolled discharges of liquid effluents and

failure to comply with operating measures set by a

release authorisation order) with limited

consequences for the environment were observed

(see Chapter 5.2.1 of DSU Report 215). This trend

was not confirmed in 2009 and 2010; this is tied to

measures taken by operators in response to

requests from ASN (general letter from ASN in late

July 2008 following the incidents of 7 July 2008 at

the Socatri facility and 17 July 2008 at the FBFC

facility).

IRSN LUDD events database: SAPIDE LUDD

The number of events leading to radiological consequences for workers is low, confirming the overall good result

observed during 2005-2008. An event involving a wound that caused internal contamination resulted in an effective

dose exceeding the regulatory annual limit. More detailed information is given in the analysis of events relating to

risks of internal exposure to ionising radiation in chapter 4.

A large share of significant events reported to ASN had operational (facility equipment and units became

unavailable) and radiological consequences inside the facility (primarily contamination of some rooms). In the vast

majority of cases, unavailability caused by these events was limited, as in 2005-2008.


4 CROSS-DISCIPLINARY ANALYSIS OF EVENTS AT LUDD FACILITIES

This chapter explains the main lessons learned from a cross-disciplinary analysis of significant

events reported to ASN during 2009 and 2010. The main differences with the conclusions of the

analysis given in the previous public report are highlighted to indicate improvements, areas where

progress has been made and main points for monitoring.

As in the previous report, for the sake of clarity the analysis has been structured by type of risk

(criticality, fire, etc.) while focusing on the most significant risks for safety and radiation

protection at LUDD facilities. In this respect, it must be stressed that IRSN did not perform analysis

on events affecting the environment that were unrelated to safety and radiation protection (i.e.,

events leading to the release of toxic or chemical substances in particular).

In addition to this analysis by risk type, IRSN analysed causes of events in order to deduce cross-

disciplinary lessons. The analysis covers event causes of a technical nature, especially those

involving ageing mechanisms which continue to be the primary cause of equipment and safety

component failures. Secondly, organisational or human causes are examined in detail since they

remain an important factor in significant events reported to ASN.

La Hague site



0

5

10

15

20

25

30

35

2007 2008 2009 2010

Barrières de confinement statique Systèmes de ventilation

4.1 EVENTS RELATING TO THE RISK OF THE DISSEMINATION OF RADIOACTIVE MATERIALS

Nearly 160 significant events relating

to risks involving the spread of

radioactive materials were reported to

ASN in 2009 and 2010. This

corresponds to approximately 50% of

reported events, a share resembling

that observed in previous years.

Share of events relating to risks involving the spread of radioactive materials for 2007-2010

The share of events relating to static confinement barriers and ventilation systems has remained stable between

2007 and 2010. None of these events had significant consequences for the environment. The consequences of these

events for staff and facilities were also limited (contamination of rooms and several cases of staff contamination).

4.1.1 EVENTS RELATED TO STATIC CONFINEMENT BARRIERS

Principle of static confinement of a LUDD-type nuclear facility (e.g.,

Melox facility)

IRSN’s analysis shows that the causes of static confinement failures are varied. In approximately half of cases,

technical causes have been identified; for the most part, they involve equipment failure due to various ageing

phenomena (corrosion, mechanical fatigue, wear, etc.) and, to a lesser degree, hazards (shock, crushing, etc.).

Design flaws were also identified in various items of equipment in approximately 30% of cases; this primarily

concerns older facilities (Tricastin, CEA facilities, etc.). Organisational and human causes dominate; they were

identified in around 75% of events involving normal operations and to a lesser extent maintenance.

Controlling risks involving the spread of radioactive materials at LUDD facilities relies on static and dynamic confinement systems and monitoring that such systems are functioning properly. Confinement of radioactive materials is ensured by one or more confinement systems, each of which is composed of one or more static confinement barriers, which may in turn be associated with a pressure cascade generated by ventilation systems intended to compensate for any weaknesses or discontinuities in static confinement barriers. Limiting release of radioactive materials into the environment through ventilation systems is ensured by purification systems for the substances involved (particle filters, iodine traps, etc.).

Ventilation systems Static confinement barriers

Second barrier workshop

About 100 events involving static

containment barriers were reported

to ASN in 2009 and 2010. As in 2005-

2008, fuel cycle facilities were most

affected by this type of event.

Third barrier building

First barrier glovebox (Transparent, leaktight containment that contains radioactive materials It is equipped with gloves )


Nearly 40% of events are related to leaks, breakdowns in various process or waste management equipment (pipes,

tanks, etc.), overfilling (of tanks in particular) or excessive filling of equipment (e.g., UF6 crystallizer).

The trend observed in 2008 of an increase over previous years in the number of events involving leaking pipes

resulting in environmental releases due to ageing or insufficient periodic testing or maintenance did not continue

in 2009 and 2010. For reference, following two events of this type in July 2008 at the Socatri and FBFC facilities,

ASN requested operators to perform a specific verification of systems using liquids with risks for the environment.

Action plans implemented by operators in

response to ASN’s request corrected flaws

related to ageing phenomena (corrosion, fatigue,

fixation system flaw, etc.) or outside causes;

testing and maintenance programmes were also

updated. The significant decrease, particularly

in 2010, in the number of events of this type

appears due to these efforts. These efforts

should be continued as part of specially adapted

programmes of periodic pipe inspection and

maintenance.

More generally, IRSN believes that it is important

for operators to seize the opportunity of the ten-

yearly safety reviews required by the TSN law to

examine the adequacy of measures to control

risks of leaks from liquid effluent pipes,

especially those located outside buildings.

In this regard, operating experience feedback from events in 2009 and 2010 confirms, as with the incident of 23

January 2009 that took place at the Sellafield site in the United Kingdom (see inset), the importance for operators

of maintaining good knowledge of pipes carrying radioactive effluents, especially those located outside buildings or

in hard-to-access areas (identification, familiarity with lines, proper isolation of unused pipes, etc.).

32%

6%22%

12%

6%

22%

Event on 23 January 2009 that occurred at a Sellafield site facility in the United Kingdom (INES level 2). This event, inventoried in the international FINAS database, involved a flow of radioactive liquid in an outside area. Investigations carried out have uncovered that this leak, which lasted several months, originated in a condensate return line connected to an internal ventilation system at the facility. The leak resulted from a lack of leaktightness in the pipe caused by inadequate torquing of a flange. This event demonstrates a loss of knowledge of pipe risks and a lack of regular pipe inspection and maintenance by the operator. Corrective measures were taken to remedy the shortcomings.

Other

Containment confinement failure

Equipment leak or rupture

Failure to comply with time periods for inspections and periodic testing or confinement requirement

Container confinement defect

Overfilling of equipment

Distribution of the types of static confinement barrier defects for 2009 and 2010

Approximately 20% of events are associated with confinement defects in various containers, a share similar to

that observed between 2005 and 2008; these defects result from containers being dropped or damaged during

handling and from ageing mechanisms (in particular, corrosion of “old” waste drums).

Approximately 6% of events are related to confinement defects in glove boxes. This type of event, which

primarily concerns the Melox facility, has declined from previous years. This facility also saw a significant

reduction in glove box confinement ruptures, which are not reported as significant events. This improvement is the

result of efforts implemented by the operator over several years to reduce the causes of the degradation of gloves

and plastic sacks on the glove boxes (rough spots in particular) and to improve conditions for performing

maintenance (ergonomics, tools used, lighting, etc.). In addition, organised efforts were made to train staff. For

IRSN, operating experience feedback from events in 2009 and 2010 highlights that one area for improvement

concerns preparation for operations (maintenance, repairs, etc.), particularly in the quality of risk analysis prior to

the operation. Considering the potential consequences of losses of confinement for workers, IRSN believes that it

is important that the operator pursue these efforts to reduce the number of such events; this matter will receive

special attention from IRSN during the next safety review of the Melox facility.

4.1.2 EVENTS RELATED TO VENTILATION SYSTEMS

30%

47%

14%

9%

Schematic diagram of the ventilation system of LUDD-type basic nuclear facility

Approximately 30% of these events involve

unexpected ventilation system shutdowns. As

indicated in the previous report, these events

primarily concern research facilities and out-of-cycle

industrial facilities (approximately 75% of events).

This significant share may be explained by stricter

safety requirements for these facilities (especially

involving accepted shutdown time for ventilation

systems).

About 60 significant events involving ventilation

systems were reported to the ASN in 2009 and

2010. Distribution of these events among the various

LUDD groups requires no additional remarks with

regard to the previous report.

Building

Offices (cold zone)

Leaks

Air filtration system

Laboratories (hot zone)

Air conditioning

Outside /Environment

Glovebox

Unexpected shutdown of ventilation system

Exceeding time period for performance of inspections and periodic testing

Failure to comply with requirements for dynamic confinement

Other type of event

Distribution of events types relating to ventilation systems for 2009-2010



A reduction in the number of events compared with previous years was observed for 2010 for research facilities

and the Centraco facility; a review of the possibly cyclical nature of this observation will be performed by IRSN as

part of a safety review of the Centraco facility which began in 2011.

Technical causes for loss of ventilation systems are diverse (electrical supply failure, ventilation I&C malfunction,

loss of compressed air, moisture in electric room or inverter, etc.); no general technical element came to light. A

non-negligible share of these ventilation shutdowns results from organisational and human failures during

operations (poor preparation, etc.). These observations resemble those made for events in 2005-2008.

A little less than 50% of significant events reported to ASN involve breaches of safety requirements relating to

dynamic confinement. Two-thirds of the events relate to breaches of various requirements, such as pressure

difference to be observed between areas with different risks (rooms, containments); these events, which concern

diverse basic nuclear facilities, have varied causes (design flaw, requalification error, etc.). No general

characteristic was demonstrated.

Around a third of these events (approximately ten) result from failure to observe the minimum efficiency required

for HEPA filters and iodine traps. When identified, causes of efficiency loss are diverse (poor filter installation,

damage to seal between cooling shroud and filter due to acid vapours, degradation of active charcoal in an iodine

trap by acid vapours, etc.). IRSN observes however that in numerous cases the cause of efficiency loss of filters or

iodine traps is not accurately identified despite investigation; for two events, HEPA filter efficiency was

determined to be correct after verification.

For IRSN, difficulties encountered by numerous

operators involve compliance with conditions defined

by standards for performing tests on filters and iodine

traps. These difficulties may be inherent in the design

of ventilation ducts (lack of tracer uniformity at

sampling points upstream and downstream from filter,

lack of leaktightness in ventilation duct, etc.) or in

testing and measurement systems (e.g., aerosol

generator). In addition to technical problems, various

human errors can also lead to erroneous assessments

of filter and iodine trap efficiency when inspections

are performed.

A high-efficiency particulate air (HEPA) filter is composed of a frame made of galvanized or stainless steel, a mineral or plastic lute (placed inside the frame to ensure leaktightness between the filtering medium and the framework) and a filtering medium, usually made of fibreglass with organic bonding material.

Leaktightness between the housing and filter is ensured by a seal usually composed of neoprene, silicone or Viton. Efficiency of HEPA filters is measured using a non-radioactive tracer (uranine) in compliance with the French NF X 44-011 standard.

Filtering Medium

Lute

Seal

Housing

In practice, the methods used require operators to have good control of conditions in order to perform tests; in

this regard it should be noted that in most cases, test operations are performed by specialist subcontractors.

For IRSN, operating experience feedback from these events shows the importance that operators must

attribute to verifying that technical conditions have been adapted to performing efficiency testing on HEPA

filters and iodine traps at their basic nuclear facilities. Special attention must also be paid to monitoring and

inspecting subcontractors performing these checks (observance of procedures, worker skills, etc.). Some

operators, well aware of these difficulties, have since planned to improve performance and monitoring of

filtration system efficiency tests.

In addition, events involving loss of efficiency in iodine traps underline the importance of strict observance of

measures, particularly organisational (manufacturer’s expiry date, restrictions on the use of solvents, maintenance

procedure for air conditioning equipment, etc.), intended to limit the presence of elements (solvents, vapours

acids, moisture, etc.) in the air that may degrade active charcoal in iodine traps. The absence of reported events

in 2010 may suggest improved compliance with these measures by the operators concerned, but this requires

confirmation.

Finally, one event in particular should be noted as part of operating experience feedback; it concerns excessive

clogging of a HEPA filter which occurred several times over a period of several months. The filter is the last level

of filtration at a facility. Excessive clogging was due to incorrect setting for the ventilation of a cutout room which

was only identified afterwards by the operator. The event highlights that “unusual” clogging of a filter, like any

other event that is not part of normal operation, must be considered as a sign of possible malfunction at a facility

that should be quickly investigated to determine the cause. The operator must implement an appropriate

organisation to identify such “weak signals” in order to handle them.

4.2 EVENTS RELATING TO RISKS OF EXPOSURE TO IONISING RADIATION

A noteworthy increase, on the order of 50%, in the annual number of significant events relating to the risks of

external or internal exposure to ionising radiation was observed over the period 2009-2010 compared with the

average observed between 2005 and 2008. Some seventy significant events were reported during 2009 and

2010.

internal exposure or “internal contamination” due to radioactive substances that have penetrated the organism through inhalation, ingestion or a skin injury (e.g., puncture or cut).

external exposure due to radioactive sources located outside the organism;

Two types of worker exposure to ionising radiation should be distinguished:


4.2.1 EVENTS RELATING TO THE RISKS OF EXTERNAL EXPOSURE TO IONISING RADIATION

Effective dose, expressed in Sievert (Sv), is associated with doses absorbed by the organism from external or internal exposure. This value cannot be measured directly but the regulatory annual dose limit applies to it for the exposure of the entire organism. In addition, this value is used to define regulated areas using threshold values corresponding to integrated doses over an hour (controlled and prohibited zones).

The number of significant reported events concerning

risks of external exposure to ionising radiation is similar

to that of previous years, some fifteen events per year.

No event had significant consequences for workers. More

particularly, no reported event resulted in exceeding

the regulatory limit for an effective dose for workers,

set at 20 mSv/year.

Effective dose

PROHIBITED ACCESS

REGULATED ACCESS

MONITORED AREA

PUBLIC AREA

REGULATED ACCESS

Events involving failure to observe radiological zoning or

access conditions in controlled areas constitute the

largest category of events reported to ASN. These events

have significantly increased (35% on average)

compared with 2005-2008 (10%).

Half of these events result from signage errors or the failure to comply with technical conditions for access or

remaining in specially regulated “orange” or prohibited “red” areas due to breaches of radiation protection rules

(inappropriate removal of signage or failure to heed it, with one event associated with radiographic testing). The

causes of these events relate primarily to organisational and human factors; operators implement corrective

measures by improving procedures, increasing operator awareness and increased monitoring of training. For IRSN,

operating experience highlights the importance that operators must attribute to measures adopted for staff access

in areas with risks of exposure to ionising radiation (technical measures, procedures, preparation for operations,

etc.), especially for specific operations. In this regard, special attention should be paid to verifying proper

knowledge and understanding of these conditions by staff and outside contractors and monitoring observance of

these measures. Among good practices for such operations, IRSN notes that an operator planned to keep a monitor

outside the entrance of a room classified as red for the entire length of an operation performed with the door open

and another operator planned to place a portable barrier at the entrance of a classified room to avoid anyone

accidentally entering an orange area.

Three events concerning irradiation facilities, including an INES level 2 event in Belgium, have attracted the

attention of the IRSN due to the similarity of the causes involved and possible consequences (see the

description of these three events in the last chapter of this report). These facilities present an increased risk of

irradiation of staff due to the use of cobalt-60 at very strong dose rates. To prevent this risk, measures are taken

to prevent staff access to irradiation rooms during irradiation (“access management measures”). The three events

had no consequence for workers but highlighted faults in access management systems for irradiation rooms.

IRSN has sent several assessments to ASN concerning two events in France calling attention to potentially general

aspects and recommending that operators of similar facilities be requested to verify that adopted measures are



0

1

2

3

4

5

2005 2006 2007 2008 2009 2010

satisfactory (in particular, effectiveness of locking systems for doors to irradiation rooms). ASN has responded by

sending letters to the operators concerned; IRSN has performed an assessment of corrective actions.

The proportion of significant events relating to radioactive sources and radioactive samples corresponds to that

observed during 2005-2008, and is approximately 30%. It primarily concerns chance discoveries of low or very low

level sources that are not inventoried by operators; they mainly involve sources associated with measurement

equipment (calibration sources), sources and very low level radioactive samples that were lost and recovered in

unexpected places, or fire detectors (few cases) misplaced when a facility is dismantled. The causes of these events

are primarily organisational and human (breaches of procedure, inadequate documents, etc.).

The causes of other types of events relating to risks of external exposure to ionising radiation (inadequate

radiological protection, monitoring equipment malfunctions, etc.) resemble those of events that occurred in

previous years.

4.2.2 EVENTS RELATING TO THE RISKS OF INTERNAL EXPOSURE TO IONISING RADIATION

The number of reported significant events concerning internal exposure risks was on the order of twenty per year

during 2009-2010. As in previous years, most of these events result from failures in measures for controlling the

spread of radioactive materials.

Nearly 70% of significant events were reported by operators as “radiological cleanliness”; a third of them

resulted in contamination of workers’ bodies or clothing. This type of event increased over 2005-2008.

Number of internal contamination events reported for 2005-2010

The number of significant events resulting in internal

contamination of workers has been less than five per year

since 2005. For the entire period, one event was classified

INES level 2 in 2009, with a committed effective dose

exceeding the regulatory limit (20 mSv/year) due to a hand

puncture.


46%

7%7%11%

11%

18% weight control

material accumulation

material control

moderation control

geometry control

other

During 2009 and 2010, a single event led to contamination through inhalation. It resulted from abnormal

environmental contamination following late detection of surface contamination. No contamination was reported

due to malfunction of equipment that protects respiratory passages or breaches of rules relating to wearing this

equipment. On the other hand, four events during the period resulted in internal contamination due to skin

injuries. IRSN paid special attention to two of the events, which occurred in facilities undergoing final shutdown

and dismantling, which had similar causes (see the description of these events in the final chapter below). These

events result from the use of protective equipment (gloves and clothing) that is not adequately resistant and a

difficult operating environment with a confined, crowded workspace and poor visibility made worse by lack of

adequate lighting. For IRSN, these events underline the importance of the preparation phase for operations in

contaminated environments (cleanup work sites, maintenance, etc.). This phase should identify operator risks and

define the most appropriate protective measures; in this context, special attention should be paid to the context

for the operation to facilitate operator performance.

4.3 EVENTS RELATING TO THE CRITICALITY RISKS

0

2

4

6

8

10

12

14

16

18

20

2005 2006 2007 2008 2009 2010

Number of significant criticality events for the period 2005 to 2010

The notable decrease observed in 2010 is mainly related to the fact that fewer events were reported by operators

of industrial fuel fabrication facilities (UO2 and MOX). Particularly in the case of the MELOX plant, IRSN has found

that this decrease coincides with the implementation of actions designed to improve fissile materials monitoring at

the various workstations.

Breakdown of events relating to the criticality risks for 2009 and 2010

The number of significant events reported to ASN that were

related to controlling criticality risks (known hereinafter as

criticality events) was 19 in 2009 and 9 in 2010 respectively.

While the year 2009 saw a continued rise in the number of

reported criticality events observed in 2008, the number of

events that occurred in 2010 is a return to the average

number observed from 2005 to 2007.

As previously observed in the case of events reported

during the period 2005 to 2008, events concerning the

control mode based on mass represent a major

proportion of the events reported in connection with

controlling criticality risks (around 45%). Around 60%

of these events resulted in effectively exceeding a

mass limit stipulated in the safety documents for the

facilities in question.

Nonetheless, none of the cases in which these limits were exceeded compromised the subcriticality of the

equipment in question, given the wide margins adopted for defining mass limits in the safety documents, which

are based on analysis of different abnormal situations.

Apart from events involving the mode of control by limiting mass, other events reported were related:

- in two cases, to undesirable accumulations of low-enriched uranium; one of these events, at the FBFC plant

in Romans-sur-Isère, is described in Chapter 5 of this report;

- in two cases, to a failure in fissile material monitoring (inadequate management of radioactive sources

containing fissile materials and no check on 235U content upon receipt of uranium solutions);

- in three cases, to an accidental ingress of water into the equipment where criticality was controlled by

limiting moderation, following leaks from the water-UF6 exchangers;

- in three cases, to a fault regarding the control mode based on geometry (position of compartments

noncompliant with minimum distances required, mainly in relation to workstations);

- in four cases, to a failure in monitoring process parameters related to the control mode based on

concentration and, in one of these cases, to a failure regarding periodic inspection of detection and

criticality alarm equipment.

With regard to the events related to controlling the mass of fissile materials, three events related to inaccurate

estimates of the mass of fissile materials that had accumulated at workstations should be highlighted in the

interests of feedback. This leads to question the practical application of guidelines implemented to monitor the

accumulation of fissile materials, particularly insofar as regards “resetting the material balance to zero” relative

to criticality following periodic cleaning of work enclosures (glove boxes, metal-clad enclosures, etc.). These

include:

- the event of 6 October 2009 at the CEA/Cadarache ATPu facility, described in Chapter 5 of this report,

concerning the discovery of a larger than expected quantity of fissile material remaining in glove boxes;

- one other event that occurred in 2010 at the ATPu facility involved the discovery of plutonium accumulated

inside an exchanger positioned downstream of a filter device on an air cooling loop for a glove box, whereas

this deposit had not been taken into consideration in the fissile material balance for the item records

concerning this equipment;

- one event that occurred in 2009 at another CEA facility, while dismantling equipment inside a metal-clad

containment, involved the discovery of uranium that had accumulated underneath a worktop and which

weighed more than the mass recorded in the safety documents; the accumulation was due to less meticulous

periodic cleaning than planned, mainly due to the fact that the facility was designed in such a way that such

cleaning operations were complicated (with cross-pieces underneath the worktop that prevented the remote

handling arm from reaching part of the floor) and inadequate checks on whether they were completed

properly.

It should be remembered that checks on fissile material masses at a workstation (glove box, metal-clad

containment, etc.), within which a maximum value must not be exceeded, are usually carried out by keeping

account in real time of the balance of the quantities of fissile materials entering and coming out of the

workstation. This balance is marred by uncertainties regarding measurements of these quantities, which must be

accounted for in order to estimate the upper bounds of the quantities present at the workstation. Nonetheless,

such uncertainties must be eliminated if it becomes too excessive and detrimental to normal operation at the

workstation. When a cleaning operation and the related inspection (check for absence of any area of


accumulation) can be performed for the entire workstation, these operations are performed periodically and are

followed by “resetting the material balance to zero”.

However, as demonstrated by the abovementioned events, it is in fact trickier to “reset to zero” if the workstation

cannot be cleaned with regard to all the equipment items used at the workstation (inside equipment that cannot

be dismantled, for example) or in the case of inaccessible spaces, in which materials may enter and accumulate. It

thus becomes more difficult to calculate the upper bounds of the residual mass of fissile materials present at the

workstation following cleaning, as required for the material balance. In particular, determining such a residual

mass by measuring the gamma or neutron radiation emitted, is not always possible, due to the high levels of

background radiation at these workstations and to the absorption of radiation by the equipments, which can result

in significantly uncertain measurements.

For IRSN, feedback regarding the events mentioned above highlights how important it is for operators to

ensure that the measures they have developed really to guarantee effective compliance with the mass limits

of fissile materials at workstations where there is a risk that fissile materials may accumulate.

In particular, such measures must make it possible to determine:

- during operating, the upper bounds of the quantities of fissile materials present at workstations, taking into

account uncertainties regarding the mass of the fissile materials input and output at each workstation,

- by excess, the residual mass of the fissile materials at workstations that must be recorded following periodic

cleaning operations in order to reset the material balance.

IRSN also stresses that operators must factor feedback regarding these events into the design of new

workstations where criticality risks are managed by means of controls on the mass of the fissile materials

present. As far as possible, it is particularly important to prevent any potential accumulation of fissile materials in

areas for which it is impossible or very complicated to check for the presence of these materials and to clean and,

with this in mind, to design equipment that can be easily dismantled so that the interior can be visually inspected.

This may also include implementing measures that make it simpler to take nuclear measurements according to

configurations that minimize measurement uncertainties or, at least, enable the detection of points where fissile

materials accumulate.

Given the cross-disciplinary nature of feedback from the event that occurred on 6 October 2009 at the ATPu

facility, ASN, in October 2009, requested all basic nuclear facility operators to check for the absence of fissile

materials accumulated at workstations where criticality is controlled by limiting the mass of fissile materials and

to present the measures taken to prevent or minimize the accumulation of fissile materials and to detect or

measure and then recover any possible accumulated materials.

Undesirable accumulations of fissile materials are also possible in equipment other than that with safe geometry

and workstations subject to control on the mass of fissile materials, as demonstrated by two events that happened

in 2009 (powder accumulated in a process ventilation system upstream of the filters, and uranium-bearing sludge

accumulated in a rainwater pipe system and in the related storm-water basin). For IRSN, these events, like the

abovementioned event involving an accumulation of plutonium inside a heat exchanger, show that, during safety

analyses, operators need to pay a great attention to researching the possible faults liable to result in an

undesirable accumulation of fissile materials and to perform appropriate inspections at regular intervals so that, if

such faults did occur, accumulations could be detected in good time.


In May 2010, while gathering feedback regarding these events, ASN asked basic nuclear facility operators to

complete the analyses submitted in response to its letter dated October 2009 (mentioned above), taking account

of ventilation pipes, gaseous effluent filters, liquid effluent pipe systems and tanks as well as systems and

procedures in which fissile materials in liquid form are used.

In addition, two events that occurred in 2010 involved exceeding a limit on the mass of fissile materials in waste

drums, mainly due to errors regarding the plutonium isotopic content used to interpret measurements, a failure to

factor in measurement uncertainty and even the absence of calibration appropriate for the workstations in

question. In June 2011, in gathering feedback on these events, ASN requested basic nuclear facility operators to

provide information regarding the nuclear data used to interpret their measurement results and regarding the

measures implemented to factor in measurement uncertainty and the calibration operations performed,

demonstrating how these measures cover the fields in which the measurement equipment is used.

Analysis of the causes of criticality-related events at LUDD facilities in 2009 and 2010 confirms the finding given in

the previous public report, namely, that a small proportion of events are due to design faults (approximately 15%)

or to equipment failure (approximately 20%) and a high proportion of events are caused by human or organisational

errors. Among the causes in which human or organisational error played a significant part, IRSN has, in particular,

found poor management of degraded situations resulting from equipment failure, faults in man-machine interfaces

related to unfamiliarity with automatic actions performed during situations other than normal operating

conditions, or incomplete or imprecise procedures. In IRSN’s opinion, these findings confirm how important it is

that operators pay attention to the organisational measures related to the operations and to the quality of

operating documents.

4.4 EVENTS RELATING TO THE RISK OF FIRE OR EXPLOSION

In 2009 and 2010, there were no major outbreaks of fire at civil nuclear LUDD facilities, thus confirming the

positive trend observed over the last four years. Following a slight increase in the number of events observed in

2009 (17 events), the number of significant events reported in 2010 fell back to the average observed for the

preceding years (12 to 13 events per year).

27%

31%

42%

Just over a quarter of the events were related to actual

outbreaks of fire or overheating entailing smoke emissions.

This downward trend was especially noticeable in 2010, when

only one event that entailed smoke emissions was reported to

ASN. The handful of fires reported in 2009 were quickly

brought under control and had no consequences for

personnel and for the environment.

Outbreak of fire or smoke emissions

Deviation from operating rules

Fire protection system malfunction

Breakdown of types of fire-related events in 2009 and 2010



The outbreaks of fire and smoke emissions had various causes (electrical equipment failure, process malfunctions,

work with hot spots, etc.); but no specific trend can be observed. In particular, operations with hot spots were

no longer the main cause of this type of event during the period 2009-2010, unlike the period 2005 to 2008

(approximately 40%).

The only two events of this kind that were reported to ASN were due to organisational faults (inadequate

preparation of operations in one case and failure to draw up a fire permit in the second). Neither of these events

led to the combustion of a ventilation filter. This improvement can be seen in the context of the action plans

implemented by the major LUDD facility operators following a series of events that occurred in 2008 which led to

the combustion of work area ventilation filters during cutting operations, in spite of the presence of protective

devices (spark arrester).

While a fall in the number of outbreaks of fire during maintenance work involving hot spots at civil nuclear LUDD

facilities can be observed, several events of this kind took place in 2010 at other types of nuclear facility. These

events, most of which were due to errors in preparations during cleanup and dismantling works, highlight the

need to remain vigilant when performing such operations. In IRSN’s opinion, operators must maintain, and even

improve, the initiatives undertaken to ensure that work with hot spots is properly prepared, especially

insofar as regards preliminary risk analysis (e.g. drawing up analysis guides). Such preparation must serve to

define the most appropriate protection and monitoring measures, depending on the nature of the operations

actually planned “in the field” and the conditions under which they are to be performed. These initiatives are

crucial in a context where the number of cleanup and dismantling operations is set to increase in the future

(reactors, UP2-400 plant at La Hague, etc.).

During 2009 and 2010, only one outbreak of fire, due to a chemical reaction between incompatible products

(cellulose contained in waste and nitric acid), was reported, caused by a failure to identify the risk. There have

been fewer cases of fire outbreaks of this type in previous years. This feedback leads us to believe that the

efforts made by nuclear LUDD facility operators to take account of the lessons learned from earlier events2 (raising

staff awareness, compliance with limitation measures regarding the use of highly oxidizing products, especially

limiting the use of organic materials) have proved effective. Sustainable improvement in this matter implies

pursuing action to raise staff awareness of these risks and, in particular, of complying with operating procedures.

2 In February 2009, ASN asked operators to examine the risks of fire related to possible reactions between organic materials and strong oxidants and to ensure that measures implemented to control such risks are suitable.

As mentioned in the previous public report, In February

2009, ASN asked operators to submit feedback on this type

of incident. In particular, the actions undertaken by the

operators (e.g. studies and test campaigns at the CEA) led

them to define additional protective measures aimed at

minimizing the risks of combustion of filters due to

incandescent particles produced during cutting operations

(e.g. installing baffle boxes).

Baffle box

Around 30% of events related to the risk of fire involve malfunctions in the fire protection system; there is

little variation in the number of this kind of event (around 4 a year). No trend has been identified insofar as

regards the equipment in question, which is extremely varied (fire compartmentation equipment, detection and

alarm systems, etc.). Two failures of fire monitoring systems should also be mentioned in the interests of

feedback. These events (prolonged disablement of monitoring at a basic nuclear facility in one case, and loss of

alarm reporting in the second case), due to inappropriate operator action, have revealed faults in I&C interface

system ergonomics. In June 2011, IRSN sent an opinion to ASN aimed at drawing its attention to the possibly

generic nature of these events for LUDD facilities and suggesting that operators be asked to learn from these

events.

In its previous public report, IRSN mentioned an event of interest for the purpose of feedback, regarding a fire

door that opened due to pressure built up due to the injection of extinguisher gas in a room where fire had

broken out. In January 2009, ASN asked the operators to send it the conclusions of the checks that they had

performed with a view to learning from this event with regard to fire sectors equipped with the extinguisher

systems in question. The main finding from this check was that the risks related to the effects of overpressure had

not always been examined in sufficient depth by the operators when installing gas extinguisher systems at their

facilities. As a result of ASN’s letter, action plans were implemented by the operators, especially at the sites most

affected by these systems (La Hague, in particular). IRSN would like to stress that, in addition to fire sectors

equipped with gas extinguisher systems, the subject of ASN’s letter, the effects of overpressure generated by

these systems could damage other safety-related equipment, apart from fire doors (e.g. static containment

barriers, etc.). The effects of overpressure must therefore be checked for all safety systems liable to be affected.

Around 40% of events related to the risk of fire involve failure to

comply with operating rules (for example, exceeding fire load limits),

which increases the risk of fire breaking out at the basic nuclear

facilities in question, as well as delays in performing periodic

inspections and tests (CEP) or failure to complete CEPs (around two

thirds of such events) related to fire protection systems. The number

of events of this kind has increased compared to preceding years.

Periodic inspections and tests (CEP) are performed during facility operating to check that safety-related equipment is available and functions correctly. The characteristics and the frequency of CEPs are defined in the safety documents.

Not one explosion was reported to have occurred at civil nuclear

LUDD facilities in 2009 and 2010. Only one significant event relating

to the risk of explosion was reported to ASN during this period. This

event, which occurred at a research facility, was the result of a

failure, due to technical problems, to apply an instruction regarding

the periodic renewal of air in unventilated tanks containing aqueous

solutions presenting a risk that hydrogen produced by radiolysis might

accumulate.

The risk of radiolysis is linked to the decomposition of materials due to ionising radiation; radiolysis of water (H2O) may thus result in the production of hydrogen (H2), an explosive gas.

Although the number of cases where explosion prevention systems failed remains very low for nuclear LUDD

facilities, operators must sustain their efforts in this area, bearing in mind the potential consequences in terms of

safety of an explosion.


4.5 EVENTS RELATING TO THE RISKS ASSOCIATED FROM HANDLING OPERATIONS

Between 2009 and 2010, there was no notable increase in the number of significant events reported to ASN related

to risks associated with handling operations compared to the average figures for 2005-2008 (15 events in two

years, against 28 events in four years). In the light of the high number of handling operations performed in LUDD-

type facilities, the number of events remains low.

The distribution of these events between fuel cycle facilities and other facility categories (2/3-1/3) is exactly the

same as between 2005 and 2008. For fuel cycle facilities, IRSN notes in particular:

- no events of this type reported to ASN in 2010 on the Tricastin site, where there were two in 2009 and four

in 2008. There is insufficient data to determine whether this improvement is temporary or whether it is a

fundamental trend resulting from measures taken by plant operators to improve the management of risks

associated with handling operations, especially using lifting trolleys;

- a substantial increase in the number of events at the La Hague site (7 events in two years, 5 of which took

place in 2010, as opposed to 9 events over 4 years); in addition, this increase involves repeats of a number of

similar events associated, in particular, with the methods for operating handling equipment. All these events

involve operations associated with process activities. While two-thirds of the events that occurred between

2005 and 2008 were purely due to technical causes, none of the events that occurred in 2009-2010 have this

type of cause. Operating feedback from events associated with handling will be assessed in detail by IRSN as

part of the UP3-A plant safety review, which began in 2011.

All these handling events occurred during operations performed regularly in facilities (in normal operation, during

maintenance or decommissioning) and involved lifting and handling equipment that is normally used for these

operations.

Approximately 60% of events led to actual load drops which, in half of all cases, involved the handling of drums

or packages containing radioactive waste for storage or retrieval. These drops chiefly had consequences for the

loads being handled (deformation or damage), but no significant impact on workers and the environment:

- in approximately 75% of cases, these events were caused by human factors (e.g. deficient checks of lifting

equipment prior to handling operations) or organisational factors (e.g. insufficient risk assessment prior to

handling operations and preparation of these operations, in particular);

- in approximately 25% of cases, events were caused by human and organisational factors associated with

technical factors (e.g. inappropriate actions by operators, sometimes related to problems with human-

machine interfaces, which are associated with malfunctions with methods for operating handling equipment).

As for technical factors, a number of events were the result of gripping system failures; however, the range of

systems used makes it difficult to identify generic technical issues;

- it is interesting to note that, in approximately one third of events, uncomfortable operating conditions were

identified as contributing to the event. In particular, poor accessibility to loads to be handled and lack of

direct visibility during tasks to be performed is a key factor for the majority of load drop events during waste

drum or package storage or retrieval operations.


Approximately 25% of handling events involve deviations from requirements (breaches of facility general

operating rules pertaining to lifting and handling, failure to comply with the statutory inspection date for handling

equipment, etc.), which could have been causes of a load drop.

These observations are similar to those relating to handling events that occurred between 2005 and 2008. For

IRSN, this implies that, in general, plant operators still need to make improvements in managing risks associated

with handling operations in LUDD-type facilities. IRSN notes in particular that, beyond assessing all possible load

drops in order to implement prevention measures (improving the reliability of handling equipment, restriction of

load movements, etc.), plant operators must continue their efforts to put measures in place to mitigate

consequences (reduction of load handling heights, design of structures damaged in the event of a drop,

dimensioning of loads, etc.) in order to take into account the fact that equipment or human failures are always

possible, even if the probability is theoretically low.

In addition, operating feedback for load drop events shows that efforts by plant operators to improve

preparation need to be continued, and even increased, for handling operations involving sensitive operational

conditions (poor accessibility to loads or lack of direct visibility during tasks to be performed) in order to

check that the intended measures are appropriate. It is also clear that operators need to pay particular

attention both to the appropriate choice of gripping systems with regard to the loads handled and to checks

performed before handling to ensure that loads are properly attached. Ultimately, analysis of the organisational

and human causes of these events confirms the importance of training for staff and external contractors and the

development of a safety culture.

Finally, one particular event at the La Hague site should be highlighted as part of operating feedback (see

description below). This is one of the only handling events between 2005 and 2010 that led to notable

consequences on equipment and facility structure.

Following analysis of this event and generic aspects that may be

relevant to other nuclear facilities, IRSN sent a report stating, in

particular, that analysis of the hazards for buildings, structures

and safety-related equipment presented by a transport vehicle

used to transfer equipment, waste containers or radioactive

material between facilities on a site, is not generally included in

facility safety reports.

On 10 February 2010, an empty transport vehicle (weighing around 30 tonnes) was manoeuvring into position to load containers of vitrified waste in the truck access room of the NPH facility DRV unit on the La Hague AREVA NC site, when it strucked the wall at the back of the room. The impact created an opening of around 3m by 2m in the wall between the hatch and the adjacent room, which was part of a controlled area.

As a result, IRSN drew the attention of ASN to the potentially generic nature of this event and recommended

requiring that basic nuclear facility operators learn lessons from it. In November 2011, following the IRSN report,

ASN asked all basic nuclear facility operators to study the risks of transport vehicles colliding with building

structures or safety-related equipment at their facilities and to define any additional measures required in order to

manage these risks. ASN asked for conclusions from these actions to be submitted within a year.



3%

36%

61%

0%

10%

20%

30%

40%

50%

60%

2005 2006 2007 2008 2009 2010

4.6 ANALYSIS OF TECHNICAL CAUSES

The analysis performed by IRSN shows that the proportion of significant events reported to ASN every year with at

least one main cause that is of a technical nature (equipment failure, design flaw, etc.) has been relatively

stable at between 40% and 45% since 2007 (see graph below).

IRSN notes that the share of equipment failures due to external causes in the distribution of technical causes of

events reported in 2009-2010 is low. The handfuls of cases recorded are all linked to meteorological events

(lightning, frost or wind). In general they led to the failure of equipment involved in the (static or dynamic)

containment of radioactive materials.

Proportion of technical causes for the period 2005 – 2010 Proportion of events by technical cause category

for 2009 2010

As was the case for 2005-2008, the majority of technical causes identified in the significant event reports for

events that occurred in 2009-2010 involve equipment or safety-related component failures. Design or

manufacturing flaws in an equipment item or safety function are implicated in approximately one third of the

significant events reported to ASN. This proportion does need to be treated carefully, however. It could be an

underestimate: identifying this type of underlying fault generally requires more thorough analysis than is given in

the documents submitted, especially for certain events which operators consider of low importance for safety.

The analysis shows that approximately two-thirds of design flaws relate to the various items of equipment involved

in the containment of radioactive materials. Design flaws are involved in several other types of particularly

significant events, like the event of 6 October 2009 that occurred at the CEA-Cadarache plutonium technology

facility. This event was a reminder of how important it is that glove boxes are designed to avoid, as far as

possible, the accumulation of fissile materials in areas where it is impossible or difficult to check for them or

clean. For IRSN, these events are reminders of the importance of robust design of basic nuclear facilities, based on

a defence-in-depth concept which aims to prevent failures, detect them quickly and limit their consequences.

Apart from external causes, equipment or safety-related component failures are due to a diverse range of causes.

External hazard

Design or manufacturing flaw

Equipment failure

30%

20%20%

30%

Approximately 20% of equipment failures are due to

electrical causes (inverter failure, isolation fault, relay

failure). This proportion is similar to that observed

between 2005 and 2008. In approximately 50% of cases,

these failures led to the shutdown of facility ventilation

systems and, in approximately 25% of cases, to the failure

of facility surveillance or radiological monitoring systems. Ageing mechanisms Mechanical or hydraulic

Other or not determined Electrical or electronic

Distribution of equipment failure causes

Approximately 20% of equipment failures are a result of occasional stresses of a mechanical or hydraulic

nature (unusually high force, overpressure). This proportion is also similar to that observed between 2005 and

2008.

Ageing mechanisms due to slow phenomena (corrosion, abrasion, thermal or mechanical fatigue, etc.) are clearly

identified in event reports for approximately 30% of equipment failures. In IRSN’s view, the actual proportion is

likely to be higher because some of the failures whose cause is not clearly identified in the documents submitted

(approximately 30% of cases) are likely to be linked, at least in part, to such mechanisms. As was the case for 2005

– 2008, therefore ageing mechanisms appear to be a cause for a high proportion of equipment failures that led to

events reported during 2009-2010. However, given the lower number of events in question, the analysis has not

yet highlighted any generic aspects or particularly notable changes in these phenomena. One of the main ways of

managing these mechanisms involves appropriate preventive maintenance or periodic inspection programmes for

facilities safety-related equipment. These programmes need to be adapted as required in order to take into

account operating feedback from events due to such ageing mechanisms.

With regard to operating feedback, IRSN underlines the worn rod big end bearings on the emergency diesel

generator engines fitted to some French power plants, which led EDF to report two significant events in 2010 and

2011. ASN classified the February 2011 event as level 2 on the INES scale, in that the premature wear of the

bearings affected all emergency diesel generator sets on the site. This failure could have led to the unavailability

of these generators in the event of loss of normal power supply. It also concerned generators from the same

manufacturer on the La Hague site and the MELOX plant. The plant operators have undertaken actions to remedy

the faults observed. Following the February 2011 event, ASN required all basic nuclear facility operators to check

that such wear mechanisms are not present on the diesel generator sets at their facilities and to submit the

findings of their investigations.



0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

2005 2006 2007 2008 2009 2010

20%

25%

10%10%

20%

10% 5%

4.7 ANALYSIS OF HUMAN AND ORGANISATIONAL CAUSES

A high proportion (approximately 75%), of significant events reported to ASN during 2009-2010 are caused by

human and organisational factors.

Share due to human and organisational causes by year

It is clear that the significant event reports have improved in this regard, but the depth of analysis given in these

documents remains variable depending on the plant operators. For a significant number of events, the reports are

still limited to a simple identification of primary causes which often goes no further than human failures

(individual errors). This observation particularly applies to events of low importance for safety. The analyses of

events classified as level 1 or level 2 on the INES scale are generally much more thorough. For IRSN, extra effort is

thus required from plant operators. They need to include analysis of more fundamental or root causes of events

reported to ASN. This is essential for identifying recurrent or generic causes and defining more relevant corrective

actions to improve safety. This comment on the content of event reports does not mean that plant operators

perform no second level analysis. The main LUDD facility operators have been performing such analyses for several

years in order to learn useful lessons for the safety of their facilities.

IRSN analysed the data in the SAPIDE LUDD database to draw out the main types of organisational or human causes

for events reported to ASN in 2009 - 2010 and identify changes from previous years.

Distribution of events by organisational causes category for 2009 - 2010

IRSN notes that the large majority of significant

events reported to ASN during 2009-2010 include an

analysis of human and organisational factors, which

was not always the case in previous years. This

improvement reflects internal organisational efforts

made by the main plant operators and enhanced staff

training with regard to human and organisational

factors.

Insufficient preparation or risk analysis

It should be noted that the content of some

event reports does not always make it possible

to allocate them a precise organisational or

human factors code for the SAPIDE LUDD

database. The data given below should

therefore be treated as illustrative.

Shortcomings associated with operating documentation

Shortcomings in the communication of information or management

Inspection shortcomings

Organisational shortcomings

Breaches of procedures or rules

Other


58%

9%2%

21%

5% 5%

11%

16%

11%

25%

8%

9%

20%

Individual faillure

Organisatioshortcommi

nalng

Failure assotraining

ciated with

breaches of procedure

man-machindefect

e interface

Work environment

Unknown

There are three main types of organisational causes for 2009 - 2010, with relatively similar weighting:

- shortcomings associated with documentation - missing documents, or more frequently, inappropriate or

inadequate documents. As was the case for 2005 - 2008, these account for a large share (approximately 25%)

of organisational factors recorded in significant event reports. These failures relate to various documents

(procedures, processes, test sequences, etc.) relating to activities associated with the normal operation of

facilities or interventions (maintenance, decontamination work, modifications, etc.);

- insufficient preparation for activities or prior risk assessment - although this category’s share is down

overall on the previous four years, this type of cause remains predominant in the specific case of interventions

such as maintenance, engineering work, etc.

- organisational shortcomings (planning, organisation of tasks between different teams, management and

monitoring of external contractors in particular); these account for approximately 20% of organisational

causes. These shortcomings and reporting failures (approximately 10%) apply in particular to events relating

to interventions and events involving failure to comply with intervals set for periodic inspections and tests of

safety-related equipment.

Distribution of events by human causes category for 2009 - 2010

However, the information given in significant event reports is not always sufficient to precisely identify the causes

of human failures. In particular, for a non-negligible proportion of cases (approximately 20%), it was not possible

to clearly identify the cause of failure by analysing the documents submitted. Other sources of human errors

(human-machine interface faults, defects associated with the working environment, etc.) are, in rare cases, also

identified by the plant operators. For IRSN, more thorough analysis of the cause of these failures and recording

them in the significant event reports would improve the overall analysis of operating feedback from these events.

Distribution of human failure causes for 2009 - 2010

As is the case for the previous four

years, the main human failures

identified in the significant events

reported during 2009-2010 are

inappropriate or forgotten actions

(approximately 80%).

Confusion

Breach of instructions

Inappropriate action

Reading error

Forgotten action

Other individual errors

In any event, a large proportion of human failures

(approximately 25%) are shown to be the result of

involuntary or deliberate breaches of rules or

instructions. A non-negligible proportion is also

the result of shortcomings in the way work is

organised.


0

5

10

15

20

25

2007 2008 2009 2010

Using the trend analyses, IRSN specifically studied organisational and human failures during periodic inspections

and tests or during interventions - two types of event that are on the increase. The reasons for breaches of

procedure and rules and for deficiencies in documentation were also studied, given that they account for a high

proportion of causes of an organisational or human nature.

4.7.1 ORGANISATIONAL OR HUMAN FAILURES ASSOCIATED WITH PERIODIC INSPECTIONS OR TESTS

The number of failures to comply with periodic inspection or test performance intervals for safety-related

equipment in LUDD-type facilities has been rising steadily since 2007. This is an overall increase for all event types

and it concerns a range of equipment (static containment, fire protection equipment, etc.) In 2009—2010,

approximately 50% of occurrences of this type of event related to fuel cycle category facilities alone.

Number of failures to comply with periodic inspection or test performance intervals for 2007 - 2010

In any case, the number of events reported in 2010 remains low in the light of the high number of periodic

inspections and tests performed every year in LUDD-type facilities. The impact of these failures on safety needs to

be put into perspective. Inspections and tests performed once these failures have been discovered show that, in the

vast majority of cases, the relevant equipment was available and that the criteria or requirements relating to this

equipment were complied with.

Instances of failures to comply with these intervals are primarily caused by organisational or human factors.

Specifically, approximately 50% of cases involve failures associated with the use of inspection planning systems:

data entry errors that go undetected or modifications to the computerised planning application used

(Computerised Maintenance Management System). In some cases, the planning systems used by workers are

inappropriate (poor levels of user-friendliness). In particular, several failures to comply with inspection intervals

should also be noted arising from confusion over dates when statutory inspections were performed on equipment

where the regulations allow for no deviation in intervals. ASN sent a letter to remind all plant operators of this in

December 2009. Also noteworthy are failures in the organisation of tasks to be performed by various teams,

insufficient communication between these teams and poor management of external contractors who perform the

majority of periodic inspections and tests in LUDD-type facilities.

This observation could be partially explained by the

ASN policy of recent years to encourage stricter

application of significant event reporting criteria for

these facilities. It should be noted that approximately

20% of these events reported in 2009 - 2010 are the

result of deviations reclassified as significant events by

ASN following facility inspections.

For IRSN, this operating feedback shows that the efforts undertaken by plant operators over recent years to reduce

the number of failures to comply with intervals have not yet come to full fruition. These actions therefore need to

be enhanced in order to deal with the causes mentioned above, in particular those relating to the planning

systems used and their operation. Some of the main LUDD facility operators are aware of the work that needs to

be done and have undertaken actions to verify the conditions for the performance of the relevant inspections in

their basic nuclear facilities (internal inspection).

It should also be noted that some significant events reported are the result of deficient information reporting with

regard to deviations observed by external contractors during periodic inspections and tests performed. This led to

delays in corrective actions to correct these deviations (e.g. switchover failure on a back-up HEPA filter line

following identification of a deficiency in HEPA filter efficiency on the line in operation). For IRSN, this operating

feedback underlines the importance that plant operators need to place on interfaces with external contractors and

on the relevant contractual provisions in order to ensure strict monitoring of periodic inspections and tests and

make it possible for them to perform any necessary corrective actions within appropriate timescales.

4.7.2 ORGANISATIONAL OR HUMAN FAILURES ASSOCIATED WITH INTERVENTIONS

IRSN observes that the number of significant events that occurred during interventions (maintenance operations,

tests, decommissioning work, modifications to facilities, etc.) increased in 2009 - 2010 (approximately 40 per

year) against 2008 (approximately 30). This increase relates most particularly to the “facilities being dismantled”

category (approximately 15 events per year in 2009 - 2010, when the number was below 10 for previous years).

Insufficient preparation of interventions and assessment of associated risks are identified in approximately

50% of cases, with no notable distinction between the main LUDD facility operators. This lack of prior preparation

or risk assessment appears to be falling in comparison with previous years, which suggests that efforts by plant

operators to deal with this type of case are, to an extent, bearing fruit. However, this type of failure was still

observed, in particular during unscheduled operations which became necessary, especially following unexpected

events during operation. These failures are often the result of individual actions without prior consultation with

the workgroup. For IRSN, this shows that it is essential for plant operators to continue to develop a safety culture

among their staff and to monitor the quality of the organisation of operations and performance conditions in order

to limit such individual unscheduled actions without prior risk assessment.

IRSN analysis shows that there are a variety of causes for failures associated with insufficient preparation or prior

risk assessment for interventions. This is especially true for basic nuclear facilities in decontamination or

dismantling phase which are unusual in that their conditions can change quickly and they are the focus of multiple

interventions at the same time. Of particular note among these deficiencies are the lack of verification, or

insufficient verification, of a facility's actual state, internal organisation failures (insufficient time to perform a

risk assessment, failure to perform an internal inspection that is adequate or relevant to the assessment, etc.),

poor identification of required conditions (lockout/tagout, line-ups, etc.) or of applicable requirements, and

failures to formalise procedures.


This operating feedback underlines the fact that actions carried out by plant operators to improve the quality of

risk assessments still need to be continued. For IRSN, particular attention should be paid to organisational

measures relating to the production of high-quality risk assessments adapted to the difficulties of safety or

radiation protection issues (prepared with a high-level team, availability of assessment guides, etc.) and especially

to competent human resources who can perform and check these assessments and prepare interventions, in

particular for facilities where multiple interventions are performed at the same time.

Failures relating to the transfer of data between people or teams, and management or inspection failures are

identified for approximately one quarter of events that occur during interventions. This proportion underlines

the importance that plant operators must place on the organisation of interventions and methods for exchanging

and transferring information between the various parties involved, especially between different teams (exchanges

between shift teams, interfaces between the plant operator and external contractor personnel, interfaces

between maintenance and operating teams, etc.). IRSN analysis shows that this type of organisational failure

occurred in over 50% of events where external contractor workers participated in interventions. Although these

events have diverse causes, the analysis shows that a significant proportion of them are the result of deficiencies

in monitoring and inspection of these personnel by the plant operator, due especially to insufficient numbers of

operator staff “on the ground”. The analysis also highlights failures associated with the training of contractor

workers, who may have a lesser understanding of the facility, how it is organised and the rules and procedures to

follow than operating staff.

For IRSN, the various points mentioned above require particular attention, in a context where specialised external

contractors are increasingly used and the main LUDD facility operators focus their activities more and more on

what is referred to as their “core activity”. Some plant operators subcontract activities that even include the

operation of facilities or parts of facilities, project management, and inspection or monitoring of service

providers. In a context like this, particular attention should be paid to the provisions in place for managing

subcontracted activities, especially when they account for a high proportion of activities carried out in some

basic nuclear facilities. For IRSN, this management requires a robust organisational structure and sufficient

human resources with the skills to perform appropriate monitoring and supervision of external contractors,

with, in particular, sufficient numbers of staff “on the ground”. It is especially important to ensure that

contractor workers have good understanding and are fully conversant with the measures to be implemented for

the operations that they are performing (understanding of procedures, safety and radiation protection

requirements, etc.). Efforts that have already been undertaken by plant operators in this area should

therefore be continued.

Deficiencies relating to post-intervention inspections and the re-configuration of facility equipment at the end

of works were observed in approximately 15% of events associated with interventions. Although the number of

events has not increased since 2007-2008 (approximately five events per year), IRSN believes that plant operators

need to continue to take great care over the re-configuration of equipment at the end of an intervention

(reactivation of alarms or detectors, removal of shunts, etc.). If this is not performed with rigorous attention,

hidden faults could remain, and become causes, or aggravating factors, of subsequent incidents.



9%

52%16%

23%

Lack of document Incomplete document Inappropriate document Other failures

4.7.3 BREACHES OF PROCEDURES AND RULES AND DEFICIENCIES IN DOCUMENTATION

Approximately 25% of significant events reported to ASN during 2009 - 2010 are associated with the use of faulty

operating documents or a lack of such documents. Approximately half of these events arise from incomplete

documentation. The lack of documents is identified in approximately 10% of cases.

Distribution of types of deficiencies associated with documents

One way to improve safety is therefore for operators to better identify the shortcomings of operating documents

used in their facilities, especially during modification of facilities or their safety reference documentation and

periodic safety reviews. Operators should also analyse the root causes of these shortcomings, i.e. the document

management process.

Approximately 15% of the significant events reported to ASN result from breaches of requirements formally laid

out in operating documents (procedures, radiation protection instructions, etc.). IRSN analysis shows that the

number of events of this type has been relatively stable for several years. It has highlighted no obvious link

between these breaches of requirements and the status of the persons involved (external service providers or not).

However, as stated in the previous IRSN public report, the cause of these breaches is rarely stated in the

significant event reports, which makes it difficult to identify generic causes.

These documentation failures relate

primarily to activities performed in the

context of normal facility operation, and a

lower proportion are related to

interventions. These deficiencies are

caused by multiple factors and show no

generic causes.

5 EVENTS AND INCIDENTS

As part of its mission to provide technical support to the nuclear safety and radiation protection authorities in

France, IRSN’s work includes monitoring safety at LUDD-type facilities in order to gain as precise an understanding

of these facilities and their operating feedback as possible. In particular, the Institute devotes extensive resources

to the expert assessment of events and incidents occurring in facilities in France or abroad, with a view to learning

useful lessons for enhancing safety. This section presents a selection of events and incidents that occurred during

2009 - 2010.

- The three decontamination- or dismantling-related events described led to consequences - two for the

workers, and the third for the facility concerned. They show that these operations are likely to present high

risks of worker exposure to ionising radiation, due to the nature of these operations which often require work

close to equipment containing radioactive materials. In addition, different risks from those encountered

during the operation of facilities may appear, due to the techniques or processes used for these operations.

These three events therefore underline the importance of the preparatory phase in such work and, in

particular, the assessment of associated risks, which must be performed extremely carefully.

- Three events related to different ionisation facilities were the result of faults in the safety system for access

to rooms where products are irradiated using very high level cobalt-60 sources. Note that these facilities

present very high risks of external exposure to ionising radiation for personnel in the event that staff enter an

irradiation room when sources are not positioned under water at the bottom of the storage pool. Preventing

these risks therefore depends on a safety system for access to the rooms with guaranteed robustness.

Fortunately, the three events described below did not have any consequences for personnel, but they show

that it is essential to be highly vigilant with regard to the reliability of these access control systems.

- Failures to manage quantities of fissile materials account for a large proportion of events reported to ASN

relating to criticality risks in LUDD-type facilities. The three events described below present various aspects of

this issue. They especially underline the importance of good facility design that limits the possibility of

exceeding masses of fissile material at work stations and robust organisational measures for prevention or

early detection of human failures during operations to inspect the masses of fissile materials.


5.1 EVENTS THAT OCCURRED DURING DECONTAMINATION OR DISMANTLING OPERATIONS

The main characteristics of nuclear facility dismantling operations

Final shutdown and dismantling operations at nuclear facilities can be spread over a long period and are carried

out in several stages which aim, first of all, to remove radioactive materials that are still present, then to

decontaminate and clean up equipment and structures, before dismantling and removing them. Risks to the

environment associated with these operations are generally lower than during the operating phrase, but the risk of

worker exposure to ionising radiation becomes higher, due to the nature of these operations which may require

personnel to work close to or “in contact” with equipment containing radioactive materials. In addition, while

some risks may no longer be relevant, such as the risk of criticality because fissile materials have been removed,

different risks from those encountered during operation can appear, due to the techniques or processes used, or

may become predominant (fire hazards associated with cutting operations with hot spots, etc.).

The organisational approach used and the management of risks associated with human factors are particularly

important given the operations performed (simultaneous actions, high degree of involvement of specialised

contractors, etc.). In any event, these operations require thorough preparation and checks of the facility to take

into account any loss of knowledge of the facility (traceability failures during operation, operating personnel not

involved in decommissioning, etc.).

In a context in which the number of final shutdown and dismantling operations at nuclear facilities is set to

continue to increase over the next few years, IRSN underlines how important it is that plant operators learn all

lessons from events that have occurred that could reduce high-level consequences for workers, in order to

continually improve the safety and radiation protection of these operations. This section presents three of the

most salient events of 2009-2010 which illustrate the issues raised by nuclear facility decontamination and

dismantling operations.

5.1.1 EVENTS THAT LED TO INTERNAL CONTAMINATION OF WORKERS

Three events involving the internal contamination of operators through injury due to deficiencies in their

protective equipment occurred in 2009-2010 during decontamination or dismantling operations. The most

remarkable occurred on 19 November 2009 at the MAU unit on the AREVA NC La Hague site, where an operator

pricked himself through his protective glove with a contaminated metal wire, leading to significant internal

contamination. This event and the one that occurred on 28 April 2010 at the CEA-Grenoble LAMA facility are

described below. They highlight the importance of the preparatory phase before work in order to identify the risks

incurred by workers and define the most appropriate methods for managing them.


EVENT OF 19 NOVEMBER 2009 AT THE MAU UNIT OF THE UP2-400 PLANT ON THE AREVA NC LA HAGUE SITE

The MAU unit is part of the first UP2-400 irradiated fuel treatment plant at the AREVA NC La Hague site. The UP2-

400 plant has been in end-of-operation phase since the end of 2003. The industrial function of the MAU unit

involved separating the uranium and plutonium contained in a nitric acid solution, then purifying the uranium. The

plutonium removed in the aqueous phase was sent to the MAPu unit at the same plant.

On 19 November 2009, an employee of an external contractor

was contaminated during a cell dusting operation. He was

working in a leaktight ventilated suit when his right hand hit

a metal wire attaching an identification tag to a pipe (see

photos). The metal wire pierced the employee’s protective

gloves and pricked him, leading to internal contamination.

Work area and metal wires

The contaminated employee was treated immediately after the accident by the site’s radiation protection and

medical departments. Initial tests showed that the worker had received internal radioactive contamination in the

form of alpha particles. Tests performed estimated that the corresponding effective dose was over the statutory

dose threshold (20 mSv). In the light of the consequences of this event, ASN classified it as level 2 on the INES

scale.

Risks of piercing of protective equipment had been identified by the plant operator (in the risk prevention plan) in

preparing the intervention. In particular, workers had fitted protections to projecting corners of equipment,

pipework and cable supports, as well as to identification tags for pipework and securing wires. The plant operator

stated that the prick was due to the fact that the metal wire had not been detected during the site preparation

phase. This wire was not directly visible because it was located behind the pipework. AREVA NC identified the

following causes of the event: the fact that the protective gloves were not adapted to resist pricks, the number of

obstructions within the cell which made it difficult to access pipework, and the type of lighting in the work area

which explains why the mounting wires were not clearly visible.

AREVA NC temporarily suspended this type of decontamination work in the unit in order to redefine working

conditions. In particular, AREVA NC searched for an “anti-prick” glove which would be better adapted to

operations planned. Tests showed that the gloves’ resistance to puncture index, which is an indicator defined by a

standard, poorly represented resistance to pricking. AREVA NC also stated that gloves made with kevlar, which are

more resistant to tearing and cutting, provided much less protection from pricks than leather gloves. In these

conditions, AREVA NC ordered the mandatory use of leather gloves for dusting operations in cells classified as

prohibited "red" areas (zone 4) at the MAU unit, and extended this measure to all decontamination operations at

the La Hague site. In addition, AREVA NC took measures that aimed to improve working conditions, especially by

improving lighting in work areas. IRSN highlights the fact that the effectiveness of leather gloves against pricking

may be limited, as shown by the incident of 14 June 2010 at a Savannah River site facility in the USA (see below).

As part of the assessment of safety files relating to the dismantling of the UP2-400 plant, AREVA NC undertook to


examine adequacy of personal protective measures, taking into account operating feedback from events involving

internal contamination by pricking.

Pierced glove from the incident on 14 June 2010

EVENT OF 28 APRIL 2010 AT THE CEA-GRENOBLE LAMA FACILITY

An event occurred on 14 June 2010 at a solid waste storage facility on the Savannah River site in the USA. A worker wearing several pairs of gloves, including leather ones, was pricked with a contaminated metal wire during an inventory operation. The effective dose received was estimated at over 20 mSv. This event was associated with the worker’s failure to comply with working procedures, and showed that leather gloves may prove inadequate to prevent pricking with small-diameter objects (see photo).

The CEA-Grenoble Active Materials Analysis Laboratory

(LAMA) is a former laboratory where uranium- or

plutonium-based fuels and structured materials for

nuclear reactors were studied after irradiation. In

September 2008, the CEA was authorised to perform final

shutdown and dismantling of this facility. Dismantling

operations began in 2009. Remaining radiological activity

is found primarily inside the “Very High Level” chambers.

View of Very High Level chamber no. 2 from the rear area door

On 28 April 2010, a worker was injured during operations to decontaminate Very High Level chamber no.2 which

presents risks of contamination and exposure (it is classified as a limited stay area). The worker was wearing a

ventilated protective suit, and injured his left buttock on a projecting metal object (miner’s bar) on his way into

the cell. Initial tests showed that the worker had received internal radioactive contamination. Tests performed

estimated that the corresponding effective dose was below the annual statutory dose threshold (20 mSv). ASN

classified this event as level 1 on the INES scale.

Investigations performed by the plant operator concluded that this event was caused by poor visibility in the work

area due to low lighting, a high number of obstructions and a breach of operating procedures involving the use of a

miner’s bar in a cell. These causes were very similar to those that led to the event of 19 November 2009 at the

MAU unit, described above.


In order to avoid a repeat of this kind of event, the CEA set up specific lighting in the work area (cold lighting).

Measures were also taken to limit obstructions and remove sharp tools (use of a crow bar instead of a miner’s bar).

Finally, the plant operator reminded workers of the safety instructions to be observed.

Conclusion for events leading to internal contamination

The two events described above illustrate the high level of risk of internal exposure for workers during

decontamination and dismantling operations in contaminated atmospheres, especially by alpha emitters. They are

a reminder that even mild injuries are a significant means of internal contamination for workers, which can have

significant radiological consequences.

Management of risks associated with these operations relies in large part on the preparatory phase, which must be

rigorous. Operating feedback from the two events presented above shows that, while plant operators should take

great care in the selection of the personal protective equipment that will be appropriate to the operations

intended, it is also essential that they pay attention to work conditions (lighting, obstructions, projecting

equipment, etc.), and to training workers and developing a safety culture.

5.1.2 EVENT OF 23 JULY 2009 AT THE CEA-MARCOULE VITRIFICATION FACILITY WHICH LED TO EXTENSIVE

SPREAD OF RADIOACTIVE MATERIALS

A significant event occurred on 23 July 2009 in the Marcoule vitrification facility located at the CEA-Marcoule site.

This unit is part of the Marcoule secret basic nuclear facility. The event led to extensive spread of radioactive

solutions inside the facility following a chemical reaction and poorly managed facility configuration. Although this

event took place in a secret basic nuclear facility which is beyond the scope of this report, IRSN felt it was

important to present it here given the number of generic lessons that can be drawn from it. It should be noted

that the chemical process leading to the event is regularly used for cleaning up equipment in nuclear facilities to

reduce contamination levels.

The mission of the Marcoule vitrification facility is to receive, store and vitrify high-level solutions. It also stores

and monitors the containers of vitrified residues produced. The event of 23 July 2009 involved the Marcoule

vitrification facility fission products storage unit. Its tanks have been used to store concentrated solutions of

fission products to be vitrified since the UP1 spent fuel treatment plant entered operation in 1958. After the plant

was decommissioned in 1997, these tanks were subject to operations to reduce the quantities of radioactive

materials stored and to rinsing operations with nitric acid. In order to continue decontamination of these tanks in

preparation for dismantling and reduce the contamination inside them, the plant operator decided to perform

rinsing using specific reagents, and especially solutions of sodium carbonate. Effluent from sodium carbonate

rinses needs to be acidified before being concentrated and vitrified in the Marcoule vitrification facility itself.

The event of 23 July 2009 involved the operation to acidify the tank of carbonate solutions by mixing them with

concentrated nitric acid. This exothermic reaction is complete, as long as the reagents are continually

homogenized. The kinetics of the reaction are rapid, releasing large quantities of carbon dioxide gas. Provisions

must therefore be put in place to manage this reaction in order to prevent overpressure risks.

On 23 July 2009, the plant operator had planned to acidify 30 m3 of carbonate solutions by transferring them into a

tank in 5 successive batches. During the fourth batch, a sudden release of carbon dioxide caused the pressure in


the tank to rise and led to an “air-lift” phenomenon where the solution was pulled up by the pressurised gas and

approximately 900 litres were ejected from the tank.

This liquid (900 litres) poured into another

tank via overflow pipes and into the room

by overflowing the tank’s compartment via

the corrosion cavity fitted to this tank. This

cavity was designed for the introduction and

withdrawal of material samples that might

be in contact with the contents of the tank.

View of cell into which corrosion cavity opens

The solution flowed from the room into other rooms, and ultimately into collector pans and floor drains where it

ran into two recovery tanks. Approximately 60 litres of solution spread beyond the retention systems in this way

and contaminated neighbouring rooms. This event caused extensive contamination of the facility but had no direct

consequences on workers or the environment. Following this event, the Representative in charge of Nuclear Safety

and Radiation Protection for Defence-related Activities and Facilities (DSND) suspended operations involving

acidification of carbonate solutions. The DSND classified this event as level 1 on the INES scale.

On the basis of investigations performed, the plant operator concluded that the event was caused by an

uncontrolled and undetected build-up of two reagents that had not reacted. This stratification phenomenon was

made possible by a difference in density between the two reagents (carbonate solution and concentrated nitric

acid) and the reaction solution which came between the two, combined with insufficient stirring of the tank

contents. When the two reagents finally mixed, the intended reaction happened very quickly, producing carbon

dioxide faster than the tank ventilation system could remove it. The plant operator had not identified this

possibility in the prior risk assessment.

The CEA adopted measures to remedy the failures observed on the basis of a detailed analysis of the event, with a

view to restarting acidification operations in acceptable safety conditions. A programme of tests was performed by

the CEA to qualify the intended modifications. All these measures were assessed by IRSN, which submitted its

opinion to the DSND.


General lessons learned from the analysis of this event

First of all, investigations showed that the tank’s

stirring system (pulser) was not appropriate for the

operation being performed. This system is designed

to flush out deposits and prevent them from

accumulating at the bottom of the tank, but does

not provide effective continual mixing of two

solutions, especially when there is a significant

difference in their density. In addition, injecting the

carbonate solution over the acid solution

encouraged their stratification.

iqu d transfer via seal failures (doors hatches plugs etc.)

iqu d transfer via purpose-des gned pipework (overflow floor drains drainage etc.)

Shielded unsealed housing (cf. Appendix 11)

Room 757 Room 859 Room 756 Floor drains

connected to tank 79.118

Shie ded housing drain

Room 852 Sampling

bench Ext I

Compartment 26A

900 litres

Compartment 26B

30 l tres

30 litres 270 itres 110 litres

from tank 79.26A to tank 79.26B Overf ow pipe

Volume of liquid involved in the event

General drawing of the facility

In addition, the extensive spread of the solution through the facility was due to the fact that some of it flowed out

via the corrosion cavity in the upper part of the tank. This cavity was not sealed and represented a defect in the

first static containment barrier that had not been identified as such by the operator in the safety file. The

offending tank was the only one of the four tanks used for acidification operations fitted with a system like this.

The cavity was not described in the fission products storage unit safety report and was not shown on the tank

schematic diagram. This event was therefore caused by insufficient preparation of acidification operations. IRSN

notes that the operating feedback shows how important it is to check that the equipment in a facility is well

adapted for other uses than it is designed for, especially during decontamination operations. This verification may

require representative tests. The event is also a reminder of how important it is to check the actual state of

equipment before commencing operations, in order to compensate for any traceability failures, especially in older

facilities.

The analysis also showed that there was insufficient monitoring of the acidification reaction. For example,

increased surveillance of representative variables (especially solution density) could have detected a build-up of

carbonate solutions in the tank. This insufficient monitoring is a consequence of the failure to identify reagent

stratification in the risk analysis performed prior to the operation. For IRSN, this operating feedback is a reminder

that all chemical reactions that could have an impact on facility safety must be monitored using appropriate

variables, in order to check that the reaction is functioning correctly and identify any deviations. It should be

noted that the plant operator developed a prior safety analysis guide for chemical processes which can be used to

estimate the nature and severity of the associated chemical risks from design of operations and processes. This

guide is now being used in Marcoule and the CEA is rolling it out across all its sites.

Given the importance of the general lessons learned from this event, in September 2010 the DSND asked secret

basic nuclear facility operators to provide operating feedback on the event, in order to identify similar equipment

or operations in their own facilities and check that chemical reactions used are monitored appropriately in order

to detect any runaway or a deviation from safety variables and act as required in order to limit their

consequences. The DSND also informed ASN of the lessons learned from this event.



5.2 EVENTS RELATING TO IONISATION FACILITIES

Ionisation facilities in France are classified as basic nuclear facilities and designed to use gamma radiation emitted

by high level active cobalt-60 sources, either for sterilising medical equipment or foodstuffs, or performing

research, studies or tests (material ageing tests, nuclear qualification tests for equipment, etc.).

All facilities of this type include a

concrete room with a pool for storing

sources outside irradiation phases.

Sources are extracted from the pool for

product irradiation operations using a

dedicated automatic remote handling

system. The general safety principles

applicable to these ionisation facilities

are specified by basic safety rule I.2.b.

Schematic diagram of an ionisation facility

Risk management principles for ionisation facilities

Ionisation facilities present very low levels of risk to the public or the environment. The main risk associated with

these facilities is the exposure of workers to ionising radiation. This risk is the result of the high dose rates

generated by cobalt-60 sources which, when in operating position, can reach 10 Gy at 1 metre and thus lead to

very serious damage for individuals in just a few seconds. Outside operating phases, the radiological screen

provided by the pool water is a prevention measure. If the sources are at the bottom of the pool, the depth of

water (5 to 6 metres) is sufficient to allow for personnel to enter the room via a specific door to carry out work

(maintenance, repairs, etc.).

During operating phases, the prevention of risks of external exposure to ionising radiation is based on radiological

shielding from the room’s concrete walls (approximately 2m thick) and the safety system used to manage personnel

access to the irradiation room and the movements of sources. The access control system must, as stated in basic

safety rule I.2.b, prevent workers accessing the irradiation room when sources are not in the safety position (at the

bottom of the pool) and, if necessary, automatically return the sources to this position. To do so, the room door

must be locked and spurious opening must cause the sources to return automatically to the safety position.

This section presents three events that occurred in 2009-2010 which were all caused by defects in irradiation room

access control provisions. Two of them took place in French facilities and one in a similar facility in Belgium.

Unloading area

Goods in Loading area

Control computer

Pool

Cobalt-60 source

Conveyor Dispatch

Loaded carrier

EVENT OF 22 JUNE 2009 AT THE IRRADIATION FACILITY ON THE POUZAUGES SITE OPERATED BY IONISOS

On 22 June 2009, the facility was in normal operating conditions under remote monitoring. At 20:14 the

“production fault” alarm appeared. The on-call worker responded and entered the room at 20:50. After dealing

with the problem, he shut the irradiation room access door at 21:03 and restarted the facility in normal

operation under remote monitoring at 21:13. At 22:10, the “safety fault” alarm appeared. The on-call worker

responded at 22:23. He observed that the access door was ajar, but showed no evidence of having been forced.

The door position contactors had detected that the door was open, and the sources had been placed in their

safety position at the bottom of the pool as intended. The worker on duty inspected the room, but found no

anomalies, closed the door again and restarted operation at 22:25. ASN required that this event be reported

during an unannounced inspection in July 2009. ASN classified it as level 1 on the INES scale, especially in the

light of its potential consequences in terms of exposure to ionising radiation.

Lock on irradiation room metal access door

The plant operator investigated and concluded that

when the access door was closed at 21:03pm, it was

not locked. It seems that the bolt had not engaged with

the opposite door, although the limit of switch

contactors indicated that it was shut. The plant

operator’s analysis determined that a stress (vibration,

movement of air, etc.) could have caused the door to

move. The limit of switch contactors on the door

detected this, shut down the conveyor and returned

the sources to the pool. The plant operator also stated

that the sources took four minutes to reach their safety

position.

In the light of the consequences that this event could have had, IRSN submitted its report to ASN based on the

report published by the plant operator. IRSN's opinion and ASN's follow-up letter can be viewed on the IRSN

website (www.irsn.fr). IRSN analysis especially highlighted the fact that the irradiation room access door closing

system did not comply with the single failure criterion, since the door opened following a single anomaly. In

addition, given that it took the sources four minutes to return to their safety position, if someone had entered the

room immediately after the spurious opening of the access door, they would have been able to reach the pool

while the ambient dose rate was still very high.

This event showed that a single failure in facility safety (access door locking system) could have led to an

undesirable situation involving someone entering the room before the sources were submerged. IRSN stated that

the facility should not continue to be operated in these conditions and that a number of actions needed to be

performed as soon as possible. Following this report, ASN asked the plant operator to implement suitable and

adequately robust compensatory measures relating to the access door in particular, and to issue a file stating the

permanent measures that it had adopted to avoid a repeat of this event. In addition, IRSN drew ASN's attention to

the generic nature of this event, and suggested that it ask operators of similar facilities to take lessons learned

from it into account.


Subsequently, IRSN analysed the plant operator’s proposal to replace the lock on the irradiation room access door.

The Institute submitted a report to ASN in June 2010 which stated that the measures proposed by the operator

would satisfactorily improve the robustness of the irradiation room access door closing system. This modification

was implemented by the operator following ASN approval.

EVENT OF 20 JANUARY 2010 AT THE POSEIDON FACILITY OPERATED BY THE CEA ON THE SACLAY SITE

The design of the Poséidon facility has a number of

differences to other French ionisation facilities, which

have a similar design to the Pouzauges ionisation facility

in which the event of 22 June 2009 occurred. The

Poséidon facility includes a pool which is half covered by

an irradiation room fitted with a conveyor that

transports products to be irradiated (see photo).

Bunker

Sources

Poséidon facility

Another difference relates to the way that the irradiation room access door provides radiological shielding, in such

a way as to ensure that the protection is identical to that provided by the very thick concrete walls of the room.

For facilities similar to Pouzauges, radiological shielding is provided by a concrete maze inside the room. In these

cases, the access door is a simple manually-opened door. The Poséidon facility has no maze, and radiological

shielding is provided directly by the very thick concrete door, which is motor-operated due to its weight. Another

specific characteristic of the Poséidon facility is that it is possible to visually check that sources are in the pool

directly from outside the room, which is not the case for other facilities.

Event description

On 20 January 2010, the cobalt-60 sources were placed in their storage position following an irradiation campaign.

The worker responsible for the source transfer operation noticed no sign of malfunction.

This worker was waiting for his colleague who was responsible

for opening the door. On his arrival, the second worker

noticed that the signalling lamps visible on the radiation

monitoring panel (see photo) showed that the ionising

radiation detection monitor inside the room had

malfunctioned, contrary to what the first worker had observed

two hours previously.

Radiation monitoring panel


The two operators found themselves in a situation where a visual check confirmed that the sources were at the

bottom of the pool, but access to the room was prohibited. The operators attributed the problem to a defect with

the bulb on the radiation detection alarm status signalling unit. This equipment could only be accessed from inside

the room, so the workers decided to manually override the room opening controls in order to change the bulb,

which required the access safety systems to be inhibited. They used a key to open the electric panel containing the

door opening motor control relay and manually switched this relay, while one of them simultaneously checked for

radiation using a radiation meter. When the door opened, the visual opening prohibition alarm was triggered.

The plant operator stated that an operating instruction specified that management should be informed by workers

if an override was to be used to open the room. The plant operator therefore reported the event to ASN, because

the workers had not complied with the operating instruction. ASN classified this event as level 1 on the INES

scale.

Following the event, the plant operator fitted a padlock to the electric panel mentioned above and implemented

organisational measures to control its use, especially involving the management of keys (which are now in the

possession of the facility manager).

IRSN analysis of this incident and the conclusions of an ASN inspection confirmed that the use of this electric panel

could have led to a person entering the irradiation room when the sources were not submerged. Given the

facility’s design, it could indeed be necessary to temporarily override the room door opening system by inhibiting

the corresponding security functions in order to perform certain interventions, and in particular to repair the

safety system equipment (especially the ambient radiation monitor in the irradiation room) located in the room

which, in the event of failure, is made inaccessible by these security systems. However, the potential for opening

the door in this way and measures adopted for managing risks associated with this type of intervention were not

presented in the facility’s safety documents.

For IRSN, the level of risk associated with such an intervention means that strict compliance with the

organisational measures substantiated by a safety analysis is essential. IRSN submitted a report to ASN pertaining

to this event which recommended that the plant operator should check the robustness of the organisational

measures associated with inhibiting irradiation room access safety functions (especially key management). In

addition, the Institute suggested that ASN ask operators of industrial irradiation facilities to take the operating

feedback from the event that occurred at the Poséidon facility into account. These various points were actioned in

letters from ASN.


EVENT OF 7 MAY 2009 AT THE IRRADIATION FACILITY OPERATED BY STERIGENICS ON THE FLEURUS INDUSTRIAL

SITE IN BELGIUM

STERIGENICS performs the sterilisation of medical materials and foodstuffs at its facility on the Fleurus industrial

site by irradiating them using cobalt-60 sources. This facility consists of two irradiation rooms named GAMMIR I and

GAMMIR II. GAMMIR I is of a generally similar design to the facility located in Pouzauges. Products to be irradiated

are positioned around the pool using an automatic conveyor (continuous treatment process). The GAMMIR II room

has no maze, so radiological shielding is provided directly by a lead door. Products to be irradiated are introduced

via this motor–operated door using a conveyor.

On 7 May 2009, a worker was loading products to be treated onto the GAMMIR II conveyor when a technician

informed him that he was entering the room to take some dimensional measurements. On completion of the

loading operation, the worker started the room door closure sequence without checking that no-one was left

inside the room. When the technician inside the room noticed that the door was almost shut, he activated one of

the emergency stop systems inside the room, which stopped the door closing. This incident had no consequences

for staff or the environment, but was classified as level 2 on the INES scale by the Belgian Nuclear Safety

Authority (AFCN).

Investigations into the event showed that it was the direct result of the failure to check whether there was

anyone inside the irradiation room prior to starting up operations. According to the information communicated to

IRSN by AFCN, the procedure used for starting up the facility had been modified following an accident on 11 March

2006 at the same facility which had led to a worker receiving very high external exposure (see the description of

this level 4 INES-scale accident in the previous public report).

To prevent this accident happening again, the plant

operator had removed the “roundsman” system (a physical

system which aimed to ensure a check was performed) for

the GAMMIR II cell. However, at the time of the event,

technical and organisational measures were in place to

check whether anyone was present in the irradiation room.

On 11 March 2006, an experienced technician received severe radiation exposure for around twenty seconds during the round he performed in the GAMMIR II irradiation room to check that there was no-one in the room. He thought that the sources were in their safety position at the bottom of the pool. IRSN specialists assessed the overexposure, which led to severe aplasia for the technician, at over 4 Gy.

Irradiation accident of 11 March 2006

AFCN specified that this event was associated with the worker’s failure to comply with these measures. In any

event, the access control measures were not sufficient to prevent the undesirable event of having someone in the

room at the beginning of the irradiation sequence.


Additional technical and organisational measures were put in place by the plant operator at AFCN's request (see

AFCN activity report on its website: www.fanc.fgov.be). In particular, measures to prevent the start-up of the

irradiation sequence using entrance/exit counters (logging mats and associated controls) in the event that there

may be people in the room were put in place. Organisational measures were also taken, one of which was that

workers wanting to enter the room should place a lock on the hydraulic piston of the system holding the sources in

order to prevent them being removed from the water.

The incident was caused by a deficiency in the access control system following modification of this system. For

IRSN, this incident underlines how important it is to check that modifying a system like this does not weaken its

robustness. More generally, it is a reminder of the care that needs to be taken with corrective measures that are

put in place to prevent a repeat of an event and to analyse them very precisely, since they could generate new

risks.

Conclusion

Given the high level of risk of external exposure to ionising radiation associated with cobalt-60 sources used in

ionisation facilities, access safety measures must be particularly robust in order to prevent workers from entering

the irradiation room when the sources are not in the safety position.

The three events described above that occurred in 2009-2010 had no consequences for personnel, but they

underline how important it is for plant operators to ensure the robustness of access control systems and the

implementation of organisational measures associated with any maintenance work in these rooms which requires

the inhibition of access safety systems during the design of ionisation facilities and following any modification to

these systems.


http://www.fanc.fgov.be/

5.3 EVENTS RESULTING FROM FAILURES TO MANAGE QUANTITIES OF FISSILE MATERIALS

Criticality risk

Criticality risk is the risk of an uncontrolled nuclear chain reaction developing inside materials containing fissile

atoms (uranium or plutonium). This type of chain reaction leads in particular to high emissions of gamma rays and

neutrons which can cause severe, even lethal, exposure for people close to the relevant equipment. An accident of

this kind produces fission products which can lead to a release of a limited quantity of radioactive material into

the environment. It is therefore essential to prevent conditions which could lead to a divergent chain reaction, a

configuration referred to as “critical”.

Fission product 1

FISSION

Neutron

Heat A b y radiation

Neutron

Uranium 235

Neutron

Fission product 2

Uranium 235 fission reaction

The safety principles adopted for criticality risk prevention in basic nuclear facilities in France are defined in basic

safety rule (FSR) no. I.3.c. This rule sets out the general “double contingency” principle, whereby a criticality

accident must not under any circumstances arise from a single anomaly, and that if it could arise from a

combination of two failures, it must be shown that they are independent and that each of them has low

probability and can be quickly detected. For more information on criticality risks and the prevention principles

adopted in LUDD-type facilities and IRSN’s expert assessment approach, readers can view the IRSN criticality risks

guide available on its website.

One of the main means of managing criticality risks involves limiting quantities of fissile materials used at work

stations with adequate margins. Below a given mass, a divergent fission chain reaction is not physically possible. In

this respect, failures in managing the quantities of fissile materials account for a large proportion of the events

reported to ASN relating to criticality risks in LUDD-type facilities. This section presents three of the most salient

events of this type, two of which were classified as level 2 on the INES scale by ASN.


INCIDENT OF 3 MARCH 2009 AT THE MELOX PLANT ON THE MARCOULE SITE

The MELOX plant is operated by MELOX SA, a subsidiary of the AREVA NC group, and has been manufacturing MOX

fuel assemblies for light water reactors since 1995. This fuel is produced from a mixture of uranium dioxide and

plutonium dioxide. Maximum production capacity is currently 195 tonnes of heavy metal (U+Pu) per year.

The incident of 3 March 2009 took place at the LCT (test chain laboratory) station at the MELOX plant laboratory,

which reproduces the main stages of MOX fuel pellet manufacture on a small scale for test purposes. Criticality

risks are prevented at the LCT station by limiting the mass of plutonium held here to 370g.

This mass limit was set by positing any quantity of

moderator materials, assuming that all the plutonium

present was grouped together and the possibility of

double plutonium loading at the station. This double-load

value was adopted to take into account any errors in the

introduction of material batches. The sub-criticality of

the LCT station would therefore still be guaranteed with

740g of plutonium and for any quantity of moderator

materials.

When neutrons move through matter they gradually lose their energy during collisions with nuclei in their environment, which increases the probability of fission. Materials that slow down (moderate) neutrons are called moderators. The lighter the nuclei (e.g. hydrogen, H2), the greater the energy transferred by the neutrons. This is why water (H2O) plays such an important role in the prevention of criticality risks.

Moderator materials

The plant operator set up a mass monitoring system which relied on input/output reports to ensure management

of the plutonium mass at this type of station. Monitoring is provided using the computerised production

management system (SIGP), which is also used for managing nuclear materials.

In late morning on Tuesday 3 March 2009, a sample

containing a mixture of uranium dioxide and plutonium

dioxide (7g of plutonium) arrived at the laboratory from

the ATALANTE facility at the CEA-Marcoule centre.

Workers checked that the mass of plutonium at the

station would still be below 370g with the introduction

of this sample, and it was placed in the LCT station.

LCT station glove box at the MELOX plant laboratory

During additional checks (especially for consistency of monitoring documents for the materials associated with the

operation), workers noted an inconsistency in the documents describing the sample's properties. While they were

waiting to clear up this inconsistency, they did not update SIGP data, which meant that the system

underestimated the fissile materials in the station.


In the early afternoon, other samples containing 71g of plutonium from a plant unit were introduced into the LCT

station. This was performed in accordance with the procedure for transfers between stations using the SIGP

system, but the introduction of the sample containing 7g of plutonium had still not been entered into the system.

During the afternoon, the inconsistency relating to the first sample was resolved and its mass (7g of plutonium)

was manually entered into the SIGP system. The next morning, the worker performing the daily LCT station status

check observed that the mass of plutonium indicated by the SIGP system was 372g (over the authorised limit of

370g). ASN classified this event as level 2 on the INES scale.

This event was associated with the introduction of fissile materials from outside the facility, which is an unusual

operation, without an immediate update of the SIGP. The plant operator investigated the event and deemed that

it was caused by human or organisational factors: there was no operating procedure for this specific type of

operation, out of the scope of the normal production flow; the criticality risk assessment for this specific type of

operation was insufficient; staff also had an incomplete understanding of how the SIGP system works. They

believed that it was programmed to issue an alert message when the 370g limit was exceeded at the LCT station in

the event of incoming fissile materials from outside the facility, but this was not the case.

Following this event, the plant operator reduced the LCT station “operating” mass limit to 350g, to provide a

further margin on the “safety” limit of 370g. It also surveyed all stations that might receive fissile materials from

outside the facility and re-assessed criticality risk prevention at these stations. In addition, movements of fissile

materials from outside the MELOX plant to the LCT were subjected to prior approval from the Plant Manager and

the department responsible for nuclear materials management, pending the implementation of definitive

measures.

For IRSN, this event underlines the care that needs to be taken with unusual operations. They need to be subject

to detailed risk assessments, specific operating documents and appropriate staff training.

INCIDENT OF 6 OCTOBER 2009 AT THE CEA-CADARACHE PLUTONIUM TECHNOLOGY FACILITY

The plutonium technology facility (ATPu) on the CEA-Cadarache site manufactured uranium and plutonium oxide

based fuels for fast neutron and light water reactors between 1962 and 2003. In 2003, the plant operator stopped

commercial production from the facility. Between September 2003 and June 2008, the ATPu reconditioned and

dispatched the manufacturing scraps still at the facility to the AREVA plant in La Hague. The final shutdown and

dismantling order for the facility was signed in March 2009, after expert assessment of the safety documents

submitted to ASN by IRSN.

On 6 October 2009, the plant operator reported a significant event to ASN involving the gradual discovery that the

masses of fissile materials retained were significantly larger than expected during glove box dismantlement

operations.


With regard to the glove box decontamination

operations performed under the final shutdown and

dismantling order, criticality risk prevention is based

on the limitation of the mass and moderation of

fissile materials. The maximum mass of fissile

materials adopted, which is common to all monitored

stations, is an estimated envelope value for the

residual mass at the station with the highest mass

according to the “material retained” account. The

annual inventory of May 2008 was based on data from

the CONCERTO program and indicated a total

retained mass of plutonium of approximately 8kg

across all the glove boxes.

Criticality risks were prevented in rooms using powders and/or pellets by limiting the mass of fissile material and moderator materials in monitored stations with one or more glove boxes. A “material retained” account was created in the so-called CONCERTO materials monitoring system as part of the control of fissile material masses at monitored stations. This made it possible to account for the quantities of materials that could not be recovered through cleaning. Masses reported as retained limited the mass of material that could be authorised for use in the relevant stations.

Prevention of criticality risks at the ATPu in operation phase

In June 2009, the review performed by the operator showed that the mass of plutonium recovered since the last

inventory was significantly higher than expected. In October 2009, another review showed that the total mass of

plutonium recovered during dismantlement performed up until this date was of the order of 22kg. Given the mass

of plutonium that was still estimated to be retained in the glove boxes, the plant operator estimated that the

mass of plutonium in the glove boxes could be as high as 39kg.

This review led the plant operator to report a

significant event to ASN on 6 October 2009. ASN

classified this event as level 2 on the INES scale,

because this underestimate had gone undetected

throughout the facility operation period and the event

was reported to ASN very late. On 14 October 2009,

ASN suspended dismantling operations in the facility

and required prior consent for the resumption of work.

Glove box in ATPu cell 33

IRSN submitted a report on this event to ASN a few days after the event was reported.

Investigations carried out by the plant operator showed that the cause of the gradual accumulation of fissile

materials in the glove boxes was associated with the fact that operation of the ATPu facility led to the spread of

fissile materials during the numerous operations to dock and undock the vessels called “jars”, to turn boats,

remove screening devices, and pour out materials that had not been fully recovered. Some glove boxes were

designed such that they created retention areas that could not be accessed without complete disassembly where

materials built up gradually and could not be detected via visual inspection. In addition, the quantification of

residual materials in the glove boxes using radiological inspections and dose rate measurements was made difficult


by obstructions in the glove boxes and the large quantities of fissile materials present. As a result, the full amount

of disseminated materials could not be recovered during cleaning operations carried out in the operating phase.

In addition, the incorrect assessment of the masses of plutonium retained was associated with uncertainties about

the masses of plutonium attributed to incoming and outgoing products (weighing of powder containers and pellet

boxes, measurement of plutonium in the waste removed, etc.). In particular, when a deviation in the mass balance

was observed after cleaning of a glove box and it could not be associated with a specific event, the plant operator

attributed it to the significant uncertainties associated with waste container measurements. This mass was

therefore allocated to the waste via an “adjustment account”, while part of it probably corresponded to actual

retention of material in the glove boxes.

During 2010 and 2011, ASN gradually authorised the plant operator to restart dismantling activities on the basis of

safety files assessed by IRSN. The operator classified glove boxes into five categories for these files in accordance

with the method used to estimate the masses of residual fissile materials. For each glove box category, material

recovery provisions were defined that took into account the new estimates.

For IRSN, this event underlines the importance of good glove box design, with criticality risk management that

involves monitoring the fissile material masses present. In particular, it is important that this equipment should be

designed as much as possible to avoid areas that cannot be accessed or cleaned, where fissile materials could build

up. In any event, if it is not possible to eliminate such areas, measures should be planned to assess any retention

or identify areas for which more thorough cleaning is required. This event also underlines how important it is that

plant operators check the robustness of provisions in place for making an upper bound estimate of masses of fissile

materials present in glove boxes during operation and especially after periodic cleaning.

Given the potentially generic nature of the event, in October 2009 ASN asked basic nuclear facility operators to

take into account the corresponding operating feedback. ASN in particular required that they perform a complete

review of the residual masses of fissile materials present at facility work stations, whether in operation or

dismantling phase. More specifically, ASN asked plant operators to specify methods for monitoring any build-up of

dismantling fissile materials, any measures that they have taken or planned for the safe recovery of residual

materials at the work stations in quantities above those estimated and the measures taken or planned to prevent

the uncontrolled build-up of residual materials at work stations. The DSND made similar requests of secret basic

nuclear facilities in November 2009. This operating feedback is being closely monitored by IRSN.


EVENT OF 19 MAY 2009 AT THE FBFC PLANT ON THE ROMANS-SUR-ISERE SITE

The Franco-Belgian Fuel Manufacturing Plant (FBFC) in Romans-sur-Isère designs, manufactures and sells uranium

dioxide fuel assemblies for PWR power plants.

URANIUM LINE

The manufacturing process includes

several stages: the conversion of uranium

hexafluoride (UF6) into uranium dioxide

(UO2); homogenisation; manufacture of

sintered pellets and the manufacture of

fuel rods; and finally the fabrication of

fuel assemblies from these rods.

Fabrication of rods

Fabrication of pellets Conversion of UF6 to UO2

COMPONENTS LINE

Manufacture of grids Manufacture of caps Skeleton assembly

FUEL ASSEMBLY (sketch)

The event of 19 May 2009 took place in the conversion facility and, more precisely, at the loading station for one

of the uranium dioxide powder homogenisation machines (homogeniser no. 4) at the facility. Uranium dioxide

powders are introduced into homogeniser no.4 by docking a Transnucléaire (TN) Gemini container to it. After the

homogenisation stage, the powder is packed in TN Gemini containers so as to be transported to the pellet

manufacture workshop. Risks associated with the spread of radioactive materials at the loading station are

managed by using sealed equipment and containers and dynamic containment via the process ventilation system to

compensate for leaktightness defects, especially in container docking areas. The docking ring of a TN Gemini

container is therefore connected to the process ventilation system, which is fitted with several filtration levels in

series.

On 19 May 2009, two technicians were replacing the pre-filter and the first stage filter on the process ventilation

system at the homogeniser no.4 loading station. They noted an unusual build-up of uranium dioxide powder on the

pre-filter and filter and inside the filtration housing (total mass over 25kg). Close inspection of the ventilation duct

showed another retention zone in a horizontal part of the duct (approximately 8kg). It is important to note that

this event did not jeopardise the sub-criticality of the facility, due to the absence of moderator materials in the

building housing the homogeniser. ASN classified this event as level 0 on the INES scale.

The plant operator investigated the accumulation of powder observed and stated that it was caused by design and

operating flaws in the process ventilation system. The plant operator reported that these failures came to light as

a result of the increase in production from homogeniser no.4, since homogenisers no. 2 and 3 had been shut down

in late 2008. More specifically, the plant operator explained this abnormal carryover of uranium dioxide by a faulty

seal in the container docking system. This defect had led to higher levels of powder intake, and an excessive

process ventilation flow rate. No maximum value had been specified in the operating documentation. In addition,

the design of the ventilation duct (horizontal part) and the filter housing contributed to the deposition of the

powder carried over.


In the light of this event, the plant operator modified the filter housing and ventilation duct of homogeniser no.4

loading station, in order to avoid creating retention areas. Checks were also performed in the other units at the

Romans-sur-Isère FBFC facility which could be affected by similar defects. The plant operator also took the

operating feedback into account with regard to filter periodic inspection and test programmes and maintenance of

docking system seals.

For IRSN, this event is a reminder that undesirable accumulation of fissile materials is possible out of safe

geometry equipment and “control mode based on mass” work stations. This event is not out of the ordinary. Other

similar events have been recently reported to ASN (especially the event of April 2011 at the FBFC facility in

Romans-sur-Isère which led to a large build-up of uranium dioxide powder in a ventilation system). This kind of

undetected accumulation could jeopardise the sub-criticality of the facility, especially in the event of another

concurrent failure such as incoming moderator materials.

This event underlines how essential it is that plant operators pay careful attention to identifying failures that

could lead to an undesirable accumulation of fissile material. It is also important that plant operators plan regular

inspections in order to detect any possible accumulations before they take on sufficient magnitude to present a

criticality risk.


6 SUMMARY

This report presents the cross-disciplinary analysis performed by IRSN relating to significant events reported to the

French Nuclear Safety Authority (ASN) during 2009 - 2010 for LUDD-type facilities (laboratories, plants, facilities

being dismantled, and waste processing, interim storage and disposal facilities). It constitutes a follow-up to DSU

Report 215 published in December 2009, relating to events reported to ASN during 2005 to 2008. The main

developments observed since the analysis presented in that report have been underlined here, in order to highlight

improvements, opportunities for progress and the main areas requiring careful attention.

These reports aim to promote the widest possible dissemination of operating feedback, and their main objective is

to draw out general lessons in order to reinforce safety in LUDD-type facilities. The type of analysis presented here

is part of the general IRSN objective to seek continual improvement in safety at basic nuclear facilities. Safety at a

nuclear facility is not something that is ever finally achieved. It must remain a priority for all parties involved, in

particular the plant operators who are primarily responsible for the safety of their facilities. It must be continually

developing, taking into account new understanding of the operating feedback available. In this regard, a

substantial proportion of improvements in safety come via careful analysis of anomalies, incidents and accidents

that have occurred in France or abroad.

For several years, IRSN has been using appropriate tools (primarily databases) to capitalise on operating feedback

from the analysis of events that have occurred in LUDD-type facilities in France and the most important events

from abroad in this type of facility. Lessons learned from this analysis increase the relevance of the expert

assessments that IRSN performs for safety authorities and are also taken into consideration in the establishment of

study and research programmes run by the Institute in order to develop its skills and improve its understanding.

The facility safety improvement approach mentioned above assumes that plant operators analyse events that they

identify as fully as possible, especially events of minor importance which could be precursors to more severe

events. In this regard, IRSN has noted an overall improvement in the content of significant event reports submitted

to ASN especially relating to organisational and human factors, but the depth of the analyses presented in these

documents continues to vary a great deal depending on the plant operator. For a still notable share of significant

events, analysis is too often limited to identifying initial causes, both the technical aspects and the organisational

and human factors. For IRSN, plant operators still have work to do to present an analysis of root causes in their

reports for significant events reported. This depth of analysis is essential for identifying recurrent or generic

causes and defining more relevant corrective actions.


The overall analysis of events reported during 2009-2010 shows that the upward trend in the number of events

reported, which was observed in 2008 against 2007 continued in 2009, although at a slower pace, before taking a

downturn in 2010, with the number of events reported approaching the 2008 figure. Any interpretation of this

change can only be tentative (especially given the differences between facilities), but it follows a high increase in

the number of events in 2008 and does not seem to be the result of a deterioration of reporting practices on the

part of plant operators. It should also be noted that the record number of events reported in 2009 was

accompanied by the declaration of three events which ASN classified as level 2 on the INES scale. Only one other

event had been classified at this level between 2005 and 2010.

With regard to the severity of events, IRSN notes that no event reported to ASN during 2009 - 2010 had severe

consequences for facilities, the environment or the health of workers and the general public. It should, however,

be underlined that an internal contamination event through injury that occurred during a decontamination

operation gave one worker an effective dose that was above the statutory annual threshold.

In addition, cross-disciplinary analysis showed that notable improvements can be seen for some types of events

that are representative of safety-related risks (2010 saw a significant drop in fire outbreaks and failures to manage

fissile material quantities in particular). This could be the result of actions carried out by the relevant plant

operators. It is, however, essential to remain extremely careful, since the corrective actions implemented in these

areas primarily concern organisational or human measures. In addition, the steady increase of radiation protection

events reported since 2008 does not suggest that practices are deteriorating, but that event reporting has

improved (especially in terms of radiological cleanliness). In this regard, although the number of these events

remains low, plant operators should pay particular attention to events involving internal contamination by injury,

in particular during decontamination or dismantling work, given the potential consequences for workers affected.

Cross-disciplinary analysis of the technical, human or organisational causes of significant events reported to ASN

during 2009-2010 does not show any significant developments in relation to the previous four years. The proportion

of events with at least one main cause of a technical nature – 40-45% - has held relatively stable for several years.

Human and organisational factors are still significant in a majority of events reported: approximately 75% of events

reported in 2009-2010 were caused by a failure of an organisational or human nature.

For technical causes, the identification of general lessons is complicated by the great diversity of process or

safety-related equipment in LUDD-type facilities, and the lack of analysis available relating to the root causes of

these events. The ageing and obsolescence of equipment still seems, however, to be identified as the greatest

cause of equipment failures for events reported during 2009-2010. At this stage, no generic aspects or very

significant developments have been identified. Efforts undertaken by plant operators to prevent the failure of

equipment contributing to facility safety due to ageing phenomena should therefore be continued. IRSN highlights

the attention that plant operators must pay to preventive maintenance programmes and periodic inspections of

this equipment in order to adapt these programmes, if necessary, to take account of operating feedback from

events caused by these mechanisms.

For causes of an organisational or human nature, the analysis performed by IRSN generally confirms the overall

lessons drawn from the analysis of events that occurred in 2005-2008. This analysis focused on events associated


with organisational or human failures during interventions or periodic inspections or tests, which are on the rise

compared with previous years. It also focused on causes of breaches of procedures or rules and deficiencies in

operating documentation.

For interventions, the main shortcomings identified (in over 50% of cases) are, as was the case for 2005–2008,

deficiencies in the preparation of actions and prior assessments of associated risks, with no notable distinction

between the main LUDD facility operators. It should be underlined that several events relating to decontamination

or dismantling operations for which these kinds of shortcomings appeared have led to workers receiving doses

(over the statutory limit in one case). Three salient events are presented in this report to illustrate this point.

IRSN believes that, although improvements have been observed (a decrease in the number of events involving lack

of preparation in particular), actions carried out by plant operators to improve the quality of risk assessments prior

to interventions need to be continued. For IRSN, particular attention needs to be paid to organisational measures

for the production of appropriate risk assessments, and especially on ensuring appropriate human resources for

writing and checking these assessments and preparing interventions, in particular for facilities in which multiple

actions are performed at the same time.

In addition, the operating feedback underlines the important role of organisational measures for managing

subcontracted activities. This requires particular care, in a context where specialised external contractors are

increasingly used and the main plant operators focus their activities more and more on their “core activity”. IRSN

notes that proper subcontractor management requires a robust organisational structure and sufficient human

resources with the skills to perform appropriate inspections and monitoring of external contractors, with, in

particular, sufficient numbers of staff “on the ground”. Efforts that have already been undertaken by plant

operators in this area should therefore be continued.

For periodic inspections and tests of equipment contributing to facility safety, IRSN notes that the number of

failures to comply with the intervals of these inspections or tests continues to rise, primarily due to organisational

or human failures. This increase seems to be the result of improved detection of these deviations by plant

operators, and could be the result of the ASN policy to encourage stricter application of significant event reporting

criteria. IRSN analysis did not show any notable change in the types of failure that caused these events. Main

causes were associated with the planning of these inspections. Aware that efforts engaged until now have not yet

borne fruit, some key LUDD facility operators have undertaken actions to perform an overall check of conditions

for these inspections. IRSN believes that the actions undertaken do indeed need to be increased.

For operating documentation, IRSN observes that the absence of operating documents or use of inappropriate or

deficient documents remains a significant cause of events reported to ASN. However, the information available

cannot be used to identify generic lessons, because plant operators do not, in general, analyse the root causes of

these events. Beyond the temporary improvements implemented by plant operators following the events that were

reported, improvements could be made by analysing the root causes of the failures in the document management

process.


APPENDIX

Reporting criteria for significant events relating to safety, radiation protection and the environment,

presented in the ASN Guide of 21 October 2005

Reporting criteria for significant events involving safety for basic nuclear facilities other than pressurised water reactors:

1 – Nuclear or non-nuclear event causing death or serious injury requiring the hospitalisation of the injured person(s), when the death or injury is caused by a failure of process-related equipment.

2 – Manual or automatic, unintentional or intentional, activation of protection and/or safeguard systems, except for intentional activation resulting from scheduled actions to maintain a major safety function.

3 – Event leading to the breach of one or more safety limits as defined in the safety reference system or the facility construction permit.

4 – Internal or external hazards for facilities: occurrence of a natural external phenomenon or one linked to human activity, or internal flooding, a fire or another phenomenon likely to have significant consequences or to affect the availability of equipment with a safety-related function.

5 – Actual or attempted malicious act likely to affect the safety of the facility.

6 – Event interfering with or potentially interfering with the integrity of hazardous materials containment.

7 – Event causing or potentially causing multiple failures: unavailability of equipment due to a single failure or a failure affecting all the trains of a redundant system or equipment of the same type involved in one or more of the facility's safety functions.

8 – Defect, degradation or failure affecting a safety function, which has had or could have serious consequences, whether detected during facility operation or outage.

9 – Event not meeting the previous criteria and affecting a safety function but which is likely to give early warning of an accident or which is of a recurring nature, without the cause being identified.

10 – Any other event likely to affect the safety of the facility deemed significant by the plant operator or the French Nuclear Safety Authority.

Reporting criteria for significant events involving radiation protection for basic nuclear facilities:

1 – Exceeding the statutory annual individual dose threshold or unforeseen situation which could, in representative and likely conditions, have resulted in exceeding a statutory annual individual dose threshold, regardless of the type of exposure.

2 – Unscheduled situation exceeding a quarter of a statutory annual dose threshold during one-off exposure, regardless of the type of exposure.

3 – Any significant deviation involving radiological cleanliness.

4 – Any activity (operation, work, modification, inspection, etc.) comprising a major radiological risk, carried out without a formalised radiation protection analysis (justification, optimisation, limitation) or without taking exhaustive account of this analysis.

5 – Actual or attempted malicious act likely to compromise the protection of workers or the general public against ionising radiation.

6 – Abnormal situation affecting a sealed or non-sealed source with a higher level than the exemption thresholds.

7 – Defective signalling of or failure to comply with technical conditions for access or spending time in a limited-stay or prohibited area (orange and red areas).



8 – Uncompensated failure of radiological monitoring systems for protection of personnel present during activities with a major radiological risk.

9 – Exceeding the inspection interval for a radiological monitoring device:

- by more than one month if a permanent collective monitoring device is involved (statutory interval of one month);

- by more than three months if other devices are involved (when the verification intervals provided for in the General Operating Rules or the radiation protection reference system are between twelve and sixty months).

10 – Any other event likely to affect radiation protection that is deemed significant by the plant operator or the French Nuclear Safety Authority.

Reporting criteria for significant events involving the environment for basic nuclear facilities:

1 – By-passing normal channels for releases with a major impact, proven breaches of one of the environmental release limits established in an order authorising draw-off and releases by the facility for radioactive substances or release of an unauthorised radioactive substance.

2 – By-passing normal channels for releases with a major impact, proven breaches of one of the environmental release limits established in an order authorising draw-off and releases by the facility for chemicals or major release of an unauthorised chemical (excluding substances depleting the ozone layer).

3 – Proven breaches of one of these release or concentration limits established in the health regulations or an order authorising draw-off and release by the facility for microbiological substances.

4 – Failure to comply with an operational provision fixed in an order authorising draw-off and releases by the facility which could have had a major environmental impact.

5 – Actual or attempted malicious act likely to affect the environment.

6 – Failure to comply with the provisions of the French Order of 31 December 1999 on technical requirements for equipment or facilities classified for environmental protection, which could have had a major environmental impact (except deviations from release orders and waste studies).

7 – Failure to comply with the waste study of the site or facility resulting in the disposal of nuclear waste via a conventional route or such as to compromise the conventional nature of the area.

8 – Discovery of a site heavily polluted by chemicals or radioactive materials.

9 – Any other event likely to affect environmental protection deemed significant by the plant operator or the French Nuclear Safety Authority.

Photo credits Page 8: EDF photo and CEA photo Page 15: AREVA NC photos – photo library Pages 16 and 18: Melox illustrations Page 27: AREVA NC photo Page 42: AREVA NC photos Page 43: DOE (USA) photo and CEA photo Page 46: CEA diagram Pages 47 and 48: IONISOS illustration and photo Page 49: CEA photos Page 54: Melox photo Page 56: CEA photo Page 58: FBFC illustration Pages 7, 9, 10, 12, 13, 16, 19, 21, 53: IRSN illustrations

Safety of laboratories, plants, facilities being ...

Documents

Transcript of Safety of laboratories, plants, facilities being ...